IP Authentication Header
RFC 4302
Document | Type |
RFC - Proposed Standard
(December 2005; Errata)
Obsoletes RFC 2402
|
|
---|---|---|---|
Author | Stephen Kent | ||
Last updated | 2020-01-21 | ||
Stream | IETF | ||
Formats | plain text html pdf htmlized with errata bibtex | ||
Stream | WG state | (None) | |
Document shepherd | No shepherd assigned | ||
IESG | IESG state | RFC 4302 (Proposed Standard) | |
Action Holders |
(None)
|
||
Consensus Boilerplate | Unknown | ||
Telechat date | |||
Responsible AD | Russ Housley | ||
Send notices to | (None) |
Network Working Group S. Kent Request for Comments: 4302 BBN Technologies Obsoletes: 2402 December 2005 Category: Standards Track IP Authentication Header Status of This Memo This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. Copyright Notice Copyright (C) The Internet Society (2005). Abstract This document describes an updated version of the IP Authentication Header (AH), which is designed to provide authentication services in IPv4 and IPv6. This document obsoletes RFC 2402 (November 1998). Table of Contents 1. Introduction ....................................................3 2. Authentication Header Format ....................................4 2.1. Next Header ................................................5 2.2. Payload Length .............................................5 2.3. Reserved ...................................................6 2.4. Security Parameters Index (SPI) ............................6 2.5. Sequence Number ............................................8 2.5.1. Extended (64-bit) Sequence Number ...................8 2.6. Integrity Check Value (ICV) ................................9 3. Authentication Header Processing ................................9 3.1. Authentication Header Location .............................9 3.1.1. Transport Mode ......................................9 3.1.2. Tunnel Mode ........................................11 3.2. Integrity Algorithms ......................................11 3.3. Outbound Packet Processing ................................11 3.3.1. Security Association Lookup ........................12 3.3.2. Sequence Number Generation .........................12 3.3.3. Integrity Check Value Calculation ..................13 3.3.3.1. Handling Mutable Fields ...................13 3.3.3.2. Padding and Extended Sequence Numbers .....16 Kent Standards Track [Page 1] RFC 4302 IP Authentication Header December 2005 3.3.4. Fragmentation ......................................17 3.4. Inbound Packet Processing .................................18 3.4.1. Reassembly .........................................18 3.4.2. Security Association Lookup ........................18 3.4.3. Sequence Number Verification .......................19 3.4.4. Integrity Check Value Verification .................20 4. Auditing .......................................................21 5. Conformance Requirements .......................................21 6. Security Considerations ........................................22 7. Differences from RFC 2402 ......................................22 8. Acknowledgements ...............................................22 9. References .....................................................22 9.1. Normative References ......................................22 9.2. Informative References ....................................23 Appendix A: Mutability of IP Options/Extension Headers ............25 A1. IPv4 Options ...............................................25 A2. IPv6 Extension Headers .....................................26 Appendix B: Extended (64-bit) Sequence Numbers ....................28 B1. Overview ...................................................28 B2. Anti-Replay Window .........................................28 B2.1. Managing and Using the Anti-Replay Window ............29 B2.2. Determining the Higher-Order Bits (Seqh) of the Sequence Number ......................................30 B2.3. Pseudo-Code Example ..................................31 B3. Handling Loss of Synchronization due to Significant Packet Loss ................................................32 B3.1. Triggering Re-synchronization ........................33 B3.2. Re-synchronization Process ...........................33 Kent Standards Track [Page 2] RFC 4302 IP Authentication Header December 2005 1. Introduction This document assumes that the reader is familiar with the terms and concepts described in the "Security Architecture for the Internet Protocol" [Ken-Arch], hereafter referred to as the SecurityShow full document text