Special Edition Using TCP/IP, Second Edition

Security Association and Internet Key Exchange

For a novice learning to cook a meal, it is not enough if all the ingredients and cooking appliances are ready. In fact, all these objects are of no use if the novice does not have a cookbook. A cookbook contains vital instructions on how much of the ingredients must be used and in what order. Security associations are similar to cookbooks from the point of view of an IPSec implementation. Additional headers, such as ESP or AH, only contain the “ingredients” for implementing security. If the SA “cookbook” does not provide instructions on how security can be implemented, the ESP or AH ingredient will be of no use in securing a datagram. The instructions provided by an SA must be present on ...