RFC 4303 - IP Encapsulating Security Payload (ESP)

Status of This Memo: Standards Track

Published: December 2005

Author: S. Kent (BBN Technologies)

Obsoletes: RFC 2406

Abstract

This document describes an updated version of the Encapsulating Security Payload (ESP) protocol, which is designed to provide a mix of security services in IPv4 and IPv6. ESP is used to provide confidentiality, data origin authentication, connectionless integrity, an anti-replay service (a form of partial sequence integrity), and limited traffic flow confidentiality. This document obsoletes RFC 2406 (November 1998).

Contents

• 1. Introduction
• 2. Encapsulating Security Payload Packet Format
  • 2.1. Security Parameters Index (SPI)
  • 2.2. Sequence Number
  • 2.3. Payload Data
  • 2.4. Padding (for Encryption)
  • 2.5. Pad Length
  • 2.6. Next Header
  • 2.7. Traffic Flow Confidentiality (TFC) Padding
  • 2.8. Integrity Check Value (ICV)
• 3. Encapsulating Security Protocol Processing
  • 3.1. ESP Header Location
  • 3.2. Algorithms
  • 3.3. Outbound Packet Processing
  • 3.4. Inbound Packet Processing
• 4. Auditing
• 5. Conformance Requirements
• 6. Security Considerations
• 7. Differences from RFC 2406
• 8. Backward-Compatibility Considerations
• 9. Acknowledgements
• 10. References
  • 10.1. Normative References
  • 10.2. Informative References
• Appendix A. Extended (64-bit) Sequence Numbers

Copyright Notice

Copyright (C) The Internet Society (2005).