IP Authentication Header
obsoletes
- rfc-2402 — IP Authentication Header
Extracted elements (30)
Mutable IP header fields are zeroed rather than omitted from ICV computation. This preserves field alignment in the ICV calculation and ensures that field lengths cannot be changed in transit even when their contents are not explicitly covered.
The ESN re-synchronization mechanism is receiver-only, to minimize impact on normal traffic, avoid new denial-of-service vectors, and maintain backward compatibility. A consecutive-failure counter triggers background retry with incrementing Seqh values to recover from losses of 2^32 or more packets.
The IPv6 Flow Label is treated as mutable (zeroed before ICV calculation) even though RFC 2460 described it as only potentially mutable. This choice retains compatibility with existing AHv1 implementations that treated the flow label as mutable.
AH does not contain a version number. Backward compatibility concerns MUST be addressed via a signaling mechanism between IPsec peers (e.g., IKE or out-of-band configuration) to ensure compatible AH versions are in use.
Use of the IPv4 Router Alert option is potentially incompatible with IPsec AH: although the option is classified as immutable, its use implies hop-by-hop packet processing by routers, which may modify the packet, and would require every router to be a member of a multicast SA.
A MINIMUM anti-replay window size of 32 packets MUST be supported; a window size of 64 is preferred and SHOULD be employed as the default. Larger windows MAY be chosen by the receiver without notifying the sender.
AH is applied only to whole (non-fragmented) IP datagrams in transport mode. If a packet offered for inbound AH processing appears to be an IP fragment (OFFSET nonzero or MORE FRAGMENTS set), the receiver MUST discard the packet; this is an auditable event.
All AH implementations MUST support the anti-replay service using a sliding receive window. The receiver MUST verify that each packet's Sequence Number does not duplicate any previously received on the SA. Duplicate checking SHOULD be the first AH check after SA matching.
Compliant implementations SHOULD NOT provide anti-replay service for SAs using manually distributed keys, because correct maintenance of counter state until key replacement is difficult and automated recovery from counter overflow is unlikely.
For multicast SAs, an IPsec implementation MUST correctly de-multiplex inbound traffic even in the context of SPI collisions by using the longest-match SAD lookup algorithm: first match on {SPI, destination, source}, then {SPI, destination}, then {SPI} or {SPI, protocol}.
If AH is incorporated into a system that supports auditing, the AH implementation MUST support auditing and MUST allow a system administrator to enable or disable auditing. There is no requirement to transmit a message to the sender upon detection of an auditable event, to avoid denial-of-service risks.
If ICV verification fails, the receiver MUST discard the received IP datagram as invalid. The receive window is updated ONLY if ICV verification succeeds.
If implicit padding is required by an integrity algorithm (to match blocksize), padding octets MUST have a value of zero and MUST be appended after the ESN high-order bits (if present). This padding is not transmitted with the packet.
If no valid SA exists for a received packet, the receiver MUST discard the packet. This is an auditable event; the audit log SHOULD include SPI, date/time, Source Address, Destination Address, and (IPv6) Flow ID.
The Reserved field (16 bits) MUST be set to zero by the sender and SHOULD be ignored by the recipient. It is included in the ICV calculation.
Use of ESN MUST be negotiated by an SA management protocol. In IKEv2, ESN is the default unless 32-bit sequence numbers are explicitly negotiated.
Extended Sequence Number (ESN) provides a 64-bit sequence number for high-speed implementations. Only the low-order 32 bits are transmitted in the AH Sequence Number field; the high-order 32 bits are maintained by sender and receiver and included in the ICV computation but not transmitted.
In transport mode, AH is inserted after the IP header and before the next-layer protocol header. In IPv6, AH appears after hop-by-hop, routing, and fragmentation extension headers but before destination options (optionally). The authenticated coverage includes immutable IP header fields and everything after AH.
In tunnel mode, AH protects the entire inner IP packet including the inner IP header. The outer IP header carries IPsec peer addresses. Mixed IPv4/IPv6 inner and outer headers are permitted.
IPv4 base header fields classified for ICV: immutable fields include Version, IHL, Total Length, Identification, Protocol, Source/Destination Address; mutable-but-predictable is Destination Address with source routing; zeroed (mutable) fields are DSCP, ECN, Flags, Fragment Offset, TTL, and Header Checksum.
IPv6 base header fields classified for ICV: immutable are Version, Payload Length, Next Header, Source/Destination Address (without routing header); mutable-but-predictable is Destination Address with Routing Extension Header; zeroed are DSCP, ECN, Flow Label, and Hop Limit.
The ICV field is variable-length and must be an integral multiple of 32 bits (IPv4 or IPv6). It may include explicit padding to satisfy IPv4 (32-bit) or IPv6 (64-bit) alignment requirements. The integrity algorithm specification MUST define the ICV length and comparison rules.
The ICV is computed over immutable or predictable IP header fields preceding AH, the AH header itself (with ICV zeroed), all data following AH, and (if ESN) the high-order 32 bits of the ESN appended after the payload. Mutable fields are zeroed rather than omitted to preserve alignment.
The Next Header field is an 8-bit field identifying the type of payload following the AH header, selected from IANA IP Protocol Numbers. For example, value 4 indicates IPv4, 41 indicates IPv6, and 6 indicates TCP.
The Payload Length field is 8 bits and specifies the length of AH in 32-bit words minus 2. For IPv6, the total AH header length must be a multiple of 8-octet units, even though length is measured in 32-bit words (unlike other IPv6 extension headers).
The Sequence Number is a mandatory 32-bit unsigned counter incremented by one per transmitted packet. Sender and receiver counters initialize to 0 at SA establishment; the first packet carries sequence number 1. The counter MUST be reset (new SA) before transmitting the 2^32nd packet when anti-replay is enabled.
The SPI is a 32-bit value used by a receiver to identify the SA to which an incoming packet is bound. SPI values 1–255 are reserved by IANA; SPI value 0 is reserved for local implementation use and MUST NOT be sent on the wire.
Security is central to AH's design. AH provides connectionless integrity, data origin authentication, and optional anti-replay protection. It does not provide confidentiality; that requires ESP. The extent of IP header coverage by AH is piecemeal because mutable fields cannot be protected.
ESN anti-replay window operates in two cases: Case A (Tl >= W-1, window within one sequence number subspace) and Case B (Tl < W-1, window spans two subspaces). State variables are T (highest authenticated sequence number) and B (window lower bound); state advances when a packet with Seq > T is received and validated.
The AH header consists of: Next Header (8-bit), Payload Length (8-bit, in 32-bit words minus 2), Reserved (16-bit, must be zero), Security Parameters Index (32-bit), Sequence Number (32-bit), and variable-length Integrity Check Value (ICV). The protocol number for AH is 51.