U5.11 Encapsulating Security Payload protocol

U5.11 Encapsulating Security Payload protocol

1. Provides for confidentiality and authentication of the payload only

   • Encryption can be offered either just for the payload or for the datagram as a whole
     • Protocol inserts a new ESP header after the IP header and a new ESP trailer after the data field.
       • This way the ESP header and trailer encapsulate the data they protect
       • Header contains the SPI and the sequence number
       • Tralier contains padding information
         • Followed by the ESP authentication field containing MAC

2. Transport mode

   • ESP header is placed between the IP and the TCP header
   • Comms end points and IPSEC endpoints coincide so 1 header is used
   • Encryption covers the the payload, including the ESP tralier, excluding the MAC
   • IP header cannot be encrypted

3. Tunnel Mode

   • Additional IP header is needed since communicating end points and IPSEC end points do not coincide
     • This is separated from the original IP header by the ESP header
       • In tunnel mode the entire original ip datagram including the IP header is encrypted
         • The new IP header contains the source and destination of the IPSEC gateways
           • Encryption covers all encapsulated data but excludes the MAC
             • If ESP is used only the payload is authnticatied

4. See pg 12 of notes for diagrams

   • Weaknesses if only ESP Auth is used
     • Only the payload is authenticated, not the IP address, leaving it open to packet forgery
   • See module for further diagram explinations

Images and files in the map