U5.10 Authentication Header

U5.10 Authentication Header

1. Implemented in transport or tunnel mode

   • In transport mode
     • AH is placed between TCP and IP headers
       • in this mode the comms endpoint and the IPSEC endpoint must coincide, only 1 header is used
         • MAC cover the application data, TCP header and most of the IP header
   • Tunnel Mode
     • Comms endpoint and IPSEC endpoint do not coincide
       • An additional IP header is added and separated from the original IP header by the AH header
         • Outer IP header contains the source and dest for the IPSEC end points
           • Inner IP header contains the potentially different source and destination addresses of the comms endpoints

2. Vital to authenticate the Source IP address so that recipient is certain the comms received is genuine and forging of packets is prevented

   • AH authenticates source IP address
     • This prevents the initiator from covering their tracks

3. Using AH all of the payload is authenticated and most of the header

   • components not authenticated are those modified on route

4. Protocol Steps

   • An authentication header is inserted into a datagram
     • Header contains a Security Parameters Index (SPI) to help locate the Security Association (SA) with with the packet is processed
       • Contains a sequence number to combat replay
         • And a MAC to provide authentication protection
       • SPI & SA provide a link to the encryption keys used to secure the comms

Images and files in the map