IP Authentication Header
RFC 4302

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 11

Network Working Group                                            S. Kent
Request for Comments: 4302                              BBN Technologies
Obsoletes: 2402                                            December 2005
Category: Standards Track

                        IP Authentication Header

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2005).

Abstract

   This document describes an updated version of the IP Authentication
   Header (AH), which is designed to provide authentication services in
   IPv4 and IPv6.  This document obsoletes RFC 2402 (November 1998).

Table of Contents

   1. Introduction ....................................................3
   2. Authentication Header Format ....................................4
      2.1. Next Header ................................................5
      2.2. Payload Length .............................................5
      2.3. Reserved ...................................................6
      2.4. Security Parameters Index (SPI) ............................6
      2.5. Sequence Number ............................................8
           2.5.1. Extended (64-bit) Sequence Number ...................8
      2.6. Integrity Check Value (ICV) ................................9
   3. Authentication Header Processing ................................9
      3.1. Authentication Header Location .............................9
           3.1.1. Transport Mode ......................................9
           3.1.2. Tunnel Mode ........................................11
      3.2. Integrity Algorithms ......................................11
      3.3. Outbound Packet Processing ................................11
           3.3.1. Security Association Lookup ........................12
           3.3.2. Sequence Number Generation .........................12
           3.3.3. Integrity Check Value Calculation ..................13
                  3.3.3.1. Handling Mutable Fields ...................13
                  3.3.3.2. Padding and Extended Sequence Numbers .....16

Kent                        Standards Track                     [Page 1]
RFC 4302                IP Authentication Header           December 2005

           3.3.4. Fragmentation ......................................17
      3.4. Inbound Packet Processing .................................18
           3.4.1. Reassembly .........................................18
           3.4.2. Security Association Lookup ........................18
           3.4.3. Sequence Number Verification .......................19
           3.4.4. Integrity Check Value Verification .................20
   4. Auditing .......................................................21
   5. Conformance Requirements .......................................21
   6. Security Considerations ........................................22
   7. Differences from RFC 2402 ......................................22
   8. Acknowledgements ...............................................22
   9. References .....................................................22
      9.1. Normative References ......................................22
      9.2. Informative References ....................................23
   Appendix A: Mutability of IP Options/Extension Headers ............25
      A1. IPv4 Options ...............................................25
      A2. IPv6 Extension Headers .....................................26
   Appendix B: Extended (64-bit) Sequence Numbers ....................28
      B1. Overview ...................................................28
      B2. Anti-Replay Window .........................................28
          B2.1. Managing and Using the Anti-Replay Window ............29
          B2.2. Determining the Higher-Order Bits (Seqh) of the
                Sequence Number ......................................30
          B2.3. Pseudo-Code Example ..................................31
      B3. Handling Loss of Synchronization due to Significant
          Packet Loss ................................................32
          B3.1. Triggering Re-synchronization ........................33
          B3.2. Re-synchronization Process ...........................33

Kent                        Standards Track                     [Page 2]
RFC 4302                IP Authentication Header           December 2005

1.  Introduction

   This document assumes that the reader is familiar with the terms and
   concepts described in the "Security Architecture for the Internet
   Protocol" [Ken-Arch], hereafter referred to as the Security