IP Encapsulating Security Payload (ESP)
RFC 4303
Document | Type |
RFC - Proposed Standard
(December 2005; Errata)
Obsoletes RFC 2406
|
|
---|---|---|---|
Author | Stephen Kent | ||
Last updated | 2020-01-21 | ||
Stream | Internent Engineering Task Force (IETF) | ||
Formats | plain text html pdf htmlized (tools) htmlized with errata bibtex | ||
Stream | WG state | (None) | |
Document shepherd | No shepherd assigned | ||
IESG | IESG state | RFC 4303 (Proposed Standard) | |
Action Holders |
(None)
|
||
Consensus Boilerplate | Unknown | ||
Telechat date | |||
Responsible AD | Russ Housley | ||
Send notices to | (None) |
Network Working Group S. Kent Request for Comments: 4303 BBN Technologies Obsoletes: 2406 December 2005 Category: Standards Track IP Encapsulating Security Payload (ESP) Status of This Memo This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. Copyright Notice Copyright (C) The Internet Society (2005). Abstract This document describes an updated version of the Encapsulating Security Payload (ESP) protocol, which is designed to provide a mix of security services in IPv4 and IPv6. ESP is used to provide confidentiality, data origin authentication, connectionless integrity, an anti-replay service (a form of partial sequence integrity), and limited traffic flow confidentiality. This document obsoletes RFC 2406 (November 1998). Table of Contents 1. Introduction ....................................................3 2. Encapsulating Security Payload Packet Format ....................5 2.1. Security Parameters Index (SPI) ...........................10 2.2. Sequence Number ...........................................12 2.2.1. Extended (64-bit) Sequence Number ..................12 2.3. Payload Data ..............................................13 2.4. Padding (for Encryption) ..................................14 2.5. Pad Length ................................................15 2.6. Next Header ...............................................16 2.7. Traffic Flow Confidentiality (TFC) Padding ................17 2.8. Integrity Check Value (ICV) ...............................17 3. Encapsulating Security Protocol Processing .....................18 3.1. ESP Header Location .......................................18 3.1.1. Transport Mode Processing ..........................18 3.1.2. Tunnel Mode Processing .............................19 Kent Standards Track [Page 1] RFC 4303 IP Encapsulating Security Payload (ESP) December 2005 3.2. Algorithms ................................................20 3.2.1. Encryption Algorithms ..............................21 3.2.2. Integrity Algorithms ...............................21 3.2.3. Combined Mode Algorithms ...........................22 3.3. Outbound Packet Processing ................................22 3.3.1. Security Association Lookup ........................22 3.3.2. Packet Encryption and Integrity Check Value (ICV) Calculation ..................................22 3.3.2.1. Separate Confidentiality and Integrity Algorithms ......................23 3.3.2.2. Combined Confidentiality and Integrity Algorithms ......................24 3.3.3. Sequence Number Generation .........................25 3.3.4. Fragmentation ......................................26 3.4. Inbound Packet Processing .................................27 3.4.1. Reassembly .........................................27 3.4.2. Security Association Lookup ........................27 3.4.3. Sequence Number Verification .......................28 3.4.4. Integrity Check Value Verification .................30 3.4.4.1. Separate Confidentiality and Integrity Algorithms ......................30 3.4.4.2. Combined Confidentiality and Integrity Algorithms ......................32 4. Auditing .......................................................33 5. Conformance Requirements .......................................34 6. Security Considerations ........................................34 7. Differences from RFC 2406 ......................................34 8. Backward-Compatibility Considerations ..........................35 9. Acknowledgements ...............................................36 10. References ....................................................36 10.1. Normative References .....................................36 10.2. Informative References ...................................37 Appendix A: Extended (64-bit) Sequence Numbers ....................38 A1. Overview ...................................................38 A2. Anti-Replay Window .........................................38 A2.1. Managing and Using the Anti-Replay Window ............39Show full document text