RFC 4302 - IP Authentication Header

Status of This Memo: Standards Track
Published: December 2005
Obsoletes: RFC 2402
Author: S. Kent (BBN Technologies)

Abstract

This document describes an updated version of the IP Authentication Header (AH), which is designed to provide authentication services in IPv4 and IPv6. This document obsoletes RFC 2402 (November 1998).

Contents

• 1. Introduction
• 2. Authentication Header Format
  • 2.1. Next Header
  • 2.2. Payload Length
  • 2.3. Reserved
  • 2.4. Security Parameters Index (SPI)
  • 2.5. Sequence Number
    • 2.5.1. Extended (64-bit) Sequence Number
  • 2.6. Integrity Check Value (ICV)
• 3. Authentication Header Processing
  • 3.1. Authentication Header Location
    • 3.1.1. Transport Mode
    • 3.1.2. Tunnel Mode
  • 3.2. Integrity Algorithms
  • 3.3. Outbound Packet Processing
    • 3.3.1. Security Association Lookup
    • 3.3.2. Sequence Number Generation
    • 3.3.3. Integrity Check Value Calculation
    • 3.3.4. Fragmentation
  • 3.4. Inbound Packet Processing
    • 3.4.1. Reassembly
    • 3.4.2. Security Association Lookup
    • 3.4.3. Sequence Number Verification
    • 3.4.4. Integrity Check Value Verification
• 4. Auditing
• 5. Conformance Requirements
• 6. Security Considerations
• 7. Differences from RFC 2402
• 8. Acknowledgements
• 9. References
  • 9.1. Normative References
  • 9.2. Informative References
• Appendix A: Mutability of IP Options/Extension Headers
  • A1. IPv4 Options
  • A2. IPv6 Extension Headers
• Appendix B: Extended (64-bit) Sequence Numbers
  • B1. Overview
  • B2. Anti-Replay Window
  • B3. Handling Loss of Synchronization

Copyright Notice

Copyright (C) The Internet Society (2005).

Author's Address

Stephen Kent
BBN Technologies
10 Moulton Street
Cambridge, MA 02138
USA

Phone: +1 (617) 873-3988
Email: [email protected]