RFC 4301 - Security Architecture for the Internet Protocol

• Status: Proposed Standard
• Published: December 2005
• Stream: IETF
• Updates: RFC3168
• Obsoletes: RFC2401
• Errata: No Errata

---

Contents

• 1. Introduction
  • 1.1. Summary of Contents of Document
  • 1.2. Audience
  • 1.3. Related Documents
• 2. Design Objectives
  • 2.1. Goals/Objectives/Requirements/Problem Description
  • 2.2. Caveats and Assumptions
• 3. System Overview
  • 3.1. What IPsec Does
  • 3.2. How IPsec Works
  • 3.3. Where IPsec Can Be Implemented
• 4. Security Associations
  • 4.1. Definition and Scope
  • 4.2. SA Functionality
  • 4.3. Combining SAs
  • 4.4. Major IPsec Databases
    • 4.4.1. The Security Policy Database (SPD)
      • 4.4.1.1. Selectors
      • 4.4.1.2. Structure of an SPD Entry
      • 4.4.1.3. More Regarding Fields Associated with Next Layer Protocols
    • 4.4.2. Security Association Database (SAD)
      • 4.4.2.1. Data Items in the SAD
    • 4.4.3. Peer Authorization Database (PAD)
      • 4.4.3.1. PAD Entry IDs and Matching Rules
      • 4.4.3.2. IKE Peer Authentication Data
      • 4.4.3.3. Child SA Authorization Data
      • 4.4.3.4. How the PAD Is Used
  • 4.5. SA and Key Management
• 5. IP Traffic Processing
• 6. ICMP Processing
• 7. Handling Fragments
• 8. Path MTU/DF Processing
• 9. Auditing
• 10. Conformance Requirements
• 11. Security Considerations
• 12. IANA Considerations
• 13. Differences from RFC 2401
• Appendix A: Glossary
• Appendix B: Decorrelation
• Appendix C: ASN.1 for an SPD Entry
• Appendix D: Fragment Handling Rationale
• Appendix E: Example of Supporting Nested SAs
• References

Status of This Memo

This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.

Abstract

This document describes an updated version of the "Security Architecture for IP", which is designed to provide security services for traffic at the IP layer. This document obsoletes RFC 2401 (November 1998).