IPsec Protection Mechanisms And Modes Of Operation

Sample Solution

IPsec's Protection Mechanisms: AH vs. ESP

IPsec offers two main mechanisms to secure data packets:

• Authentication Header (AH): Provides data integrity and origin authentication. It adds a header to the IP packet containing a digital signature calculated over the original data and a sequence number. This ensures data hasn't been tampered with during transmission and verifies the sender's identity. However, AH doesn't encrypt the data itself.

• Encapsulating Security Payload (ESP): Offers confidentiality, authentication, and integrity. ESP encrypts the entire data payload of the packet along with a new header containing authentication information similar to AH. This ensures confidentiality as only authorized parties can decrypt the data, while also providing authentication and integrity like AH.

• Confidentiality: Only ESP offers it by encrypting the data.
• Authentication & Integrity: Both AH and ESP provide these, though AH offers less protection as the data itself remains unencrypted.

• Transport Mode: Encrypts only the data portion (payload) of the original packet. The original IP header remains unencrypted. This mode is useful when communication only needs to be secured between specific endpoints (source and destination devices).
• Tunnel Mode: Encrypts the entire original packet, including both the data payload and the IP header. A new IP header is added for routing purposes. This mode offers more protection as the entire packet is secured, even if it traverses multiple networks.

• It secures the entire packet, including routing information, which might be sensitive.
• It hides the original source and destination IP addresses, adding an extra layer of anonymity.