IP Encapsulating Security Payload (ESP)
obsoletes
- rfc-2406 — IP Encapsulating Security Payload (ESP)
Extracted elements (30)
Mandatory-to-implement algorithms are defined in a separate RFC rather than in this document, to allow algorithm requirements to be updated independently of the ESP protocol specification itself.
TFC padding (Section 2.7) and dummy packets (Next Header = 59, Section 2.6) are provided as separate, complementary mechanisms because the 255-byte Padding field alone is too limited to effectively conceal traffic characteristics. Together, they allow variable-length real and dummy packets that better support traffic flow confidentiality.
The encrypt-then-authenticate ordering (encryption performed first, ICV computed over ciphertext) was chosen to facilitate rapid detection and rejection of replayed or bogus packets before decryption, reducing DoS impact, and to enable parallel decryption and integrity checking at the receiver.
ESP does not contain a version number, so backward compatibility concerns MUST be addressed by a signaling mechanism between peers (e.g., IKEv2) or an out-of-band configuration mechanism to ensure compatible versions of ESP are in use.
For ESN, if a receiver chooses not to enable anti-replay for an SA, the receiver SHOULD NOT negotiate ESN, because managing the anti-replay window (required to reconstruct the high-order ESN bits for ICV computation) contradicts the intent of disabling anti-replay.
A multicast-capable ESP implementation MUST correctly de-multiplex inbound traffic even when SPI collisions exist between group and unicast SAs. SAD lookup MUST follow a longest-match ordering: {SPI, destination, source} first, then {SPI, destination}, then {SPI} or {SPI, protocol}.
An ESP implementation MUST support generation of ICMP PMTU messages (or equivalent internal signaling) to minimize fragmentation. An implementation MAY choose not to support fragmentation and may set the DF bit.
ESN SHOULD be implemented to support high-speed IPsec, and use of ESN MUST be negotiated by an SA management protocol. In IKEv2 the default is ESN unless 32-bit sequence numbers are explicitly negotiated.
For outbound processing with separate confidentiality and integrity algorithms, encryption MUST be performed before the integrity algorithm is applied, and the encryption MUST NOT encompass the ICV field. For inbound processing, integrity checking MUST complete before the decrypted packet is passed on for further processing.
For unicast and single-sender multicast SAs, the sender MUST increment the Sequence Number field for every transmitted packet. If anti-replay is enabled, the sender MUST NOT transmit a packet that would cause the sequence number counter to cycle; a new SA (and new key) MUST be established before the 2^32nd packet is sent.
If a received ESP packet appears to be an IP fragment (OFFSET field non-zero or MORE FRAGMENTS flag set), the receiver MUST discard it; this is an auditable event. Reassembly is performed prior to ESP inbound processing.
If default padding is used (no algorithm-specified content), Padding bytes MUST be the sequence 1, 2, 3, … and receivers SHOULD inspect and verify the Padding field before removing it. If an algorithm constrains padding values, those constraints MUST be specified in the algorithm's RFC.
If ESP is incorporated into a system that supports auditing, the ESP implementation MUST also support auditing and MUST allow an administrator to enable or disable it. Auditable events include: no valid SA, IP fragment offered, sequence number overflow attempt, anti-replay check failure, and integrity check failure.
If TFC padding is added to a packet, the field in the IP datagram that specifies its length MUST NOT be modified to reflect this padding; the receiver uses this original length to locate and discard the TFC padding. The SA management protocol MUST negotiate TFC use before a transmitter employs it.
Integrity-only ESP (NULL encryption with an integrity algorithm) MUST be offered as a service selection option and MUST be negotiable in SA management protocols and configurable via management interfaces. Both confidentiality and integrity algorithms MUST NOT be simultaneously NULL.
The anti-replay service MUST NOT be enabled unless the integrity service is also enabled for the SA, because otherwise the Sequence Number field has not been integrity protected. All ESP implementations MUST support anti-replay, though receivers may disable it per-SA.
Extended Sequence Numbers (ESN) provide a 64-bit sequence number for high-speed implementations. Only the low-order 32 bits are transmitted in the ESP header; the high-order 32 bits are maintained locally and included in the ICV computation but not transmitted (for separate integrity algorithms).
In transport mode, ESP is inserted after the IP header (and any options/extension headers) and before the next-layer protocol header. In tunnel mode, ESP encapsulates the entire inner IP packet; the outer IP header contains IPsec peer addresses. Mixed IPv4/IPv6 inner and outer headers are permitted.
Payload Data is a mandatory, variable-length field containing the encapsulated data described by the Next Header field. If the encryption algorithm requires an explicit IV, it is carried at the start of the Payload field; the IV length and structure MUST be defined in the algorithm's RFC.
The Integrity Check Value (ICV) is an optional variable-length field computed over the ESP header, Payload, and ESP trailer (including implicit high-order ESN bits). It is present only when the integrity service is selected; its length and comparison rules MUST be specified by the integrity algorithm RFC.
The Next Header field is a mandatory 8-byte field identifying the type of data in the Payload. Protocol value 59 ('no next header') MUST designate a dummy TFC packet; a transmitter MUST be able to generate such packets and a receiver MUST silently discard them without indicating an error.
The Padding field (0–255 bytes) ensures that (a) the plaintext is a multiple of the encryption algorithm's block size and (b) the ICV field is aligned on a 4-byte boundary. When no algorithm-specific padding content is required, bytes are filled with the monotonically increasing sequence 1, 2, 3, …
The Security Parameters Index (SPI) is a mandatory 32-bit field used by the receiver to identify the SA to which an incoming packet belongs. SPI value 0 is reserved for local implementation use and MUST NOT be sent on the wire; values 1–255 are reserved by IANA for future use.
Traffic Flow Confidentiality (TFC) padding is an optional variable-length field inserted within the Payload Data after the real payload and before the Padding field. It can be used only when the payload contains an explicit length field (always true in tunnel mode), and its use MUST be negotiated via the SA management protocol for backward compatibility.
If the key used to compute an ICV is manually distributed, a compliant implementation SHOULD NOT provide anti-replay service, because correct anti-replay requires maintaining the sequence number counter across reboots with no automated recovery on counter overflow.
The requirement for ESP receivers to accept IP fragments for reassembly creates denial-of-service vulnerabilities; an implementation MAY choose not to support fragmentation and MUST support ICMP PMTU signaling to minimize fragmentation likelihood.
There is no requirement for a receiver to transmit any message to the purported sender in response to detection of an auditable event (e.g., integrity failure, anti-replay failure), because doing so could induce denial-of-service via forged packets triggering responses.
Using encryption without a strong integrity mechanism (encryption-only ESP) generally provides defense only against passive attackers; it may be insecure against active attacks. An underlying integrity service applied before encryption also does not necessarily protect confidentiality against active attackers.
Anti-replay is enforced using a sliding receive window. The right edge represents the highest validated Sequence Number; packets below the left edge are rejected. On integrity verification success the window is updated; on failure the packet is discarded and the window is not advanced. A minimum window size of 32 MUST be supported; 64 SHOULD be the default.
An ESP packet begins with a 32-bit SPI field and a 32-bit Sequence Number, followed by variable-length Payload Data (which may include an IV and TFC padding), then Padding (0–255 bytes), a 1-byte Pad Length, a 1-byte Next Header, and an optional variable-length ICV. The outer IP header MUST carry protocol number 50.