RFC 4303 - IP Encapsulating Security Payload (ESP)

• Status: Proposed Standard
• Published: December 2005
• Stream: IETF
• Obsoletes: RFC2406
• Errata: No Errata

---

Abstract

This document describes an updated version of the Encapsulating Security Payload (ESP) protocol, which is designed to provide a mix of security services in IPv4 and IPv6. ESP is used to provide confidentiality, data origin authentication, connectionless integrity, an anti-replay service (a form of partial sequence integrity), and limited traffic flow confidentiality. This document obsoletes RFC 2406 (November 1998).

Contents

• 1. Introduction
• 2. Encapsulating Security Payload Packet Format
  • 2.1. Security Parameters Index (SPI)
  • 2.2. Sequence Number
    • 2.2.1. Extended (64-bit) Sequence Number
  • 2.3. Payload Data
  • 2.4. Padding (for Encryption)
  • 2.5. Pad Length
  • 2.6. Next Header
  • 2.7. Traffic Flow Confidentiality (TFC) Padding
  • 2.8. Integrity Check Value (ICV)
• 3. Encapsulating Security Protocol Processing
  • 3.1. ESP Header Location
  • 3.2. Algorithms
  • 3.3. Outbound Packet Processing
  • 3.4. Inbound Packet Processing
• 4. Auditing
• 5. Conformance Requirements
• 6. Security Considerations
• 7. Differences from RFC 2406
• 8. Backward-Compatibility Considerations
• 9. Acknowledgements
• 10. References
  • 10.1. Normative References
  • 10.2. Informative References
• Appendix A. Extended (64-bit) Sequence Numbers
  • A1. Overview
  • A2. Anti-Replay Window
    • A2.1. Managing and Using the Anti-Replay Window
    • A2.2. Determining the Higher-Order Bits (Seqh) of the Sequence Number
    • A2.3. Pseudo-Code Example
  • A3. Handling Loss of Synchronization due to Significant Packet Loss
    • A3.1. Triggering Re-synchronization
    • A3.2. Re-synchronization Process

Copyright Notice

Copyright (C) The Internet Society (2005).