The IMS: IP Multimedia Concepts And Services, Second Edition

22.5. Encapsulated Security Payload (ESP)

Encapsulated Security Payload (ESP) is used to provide security services in IPv4 and IPv6. It can be used alone or in unison with an AH. It can provide either confidentiality (i.e., encryption) or integrity protection (i.e., authentication), or both. As mentioned previously, ESP can operate in transport mode and in tunnel mode.

The ESP header is inserted into the IP datagram after the IP header and before any upper layer protocol headers in transport mode, or before an encapsulated IP datagram in tunnel mode. Figure 22.1 illustrates the ESP packet format.

The fields in the ESP header are as follows:

• The SPI – a unique and random 32-bit value that, together with the destination IP address and security protocol, uniquely identifies the SA for the packet.

• The sequence number – a monotonically increasing 32-bit counter used to protect against replay attacks. When an SA is established the sequence number is reset to 0.

• Payload data – a variable length field that typically contains the data payload, whose type is denoted by the next header field. It may also contain cryptographic synchronization data, such as an IV.

• Padding – used to fill the payload data to a specific block size multiple required by a particular encryption algorithm, or to randomize the length of the payload in order to protect against traffic flow analysis.

• Pad length – an 8-bit field whose value indicates in bytes the length of the padding field.

• Next header – an 8-bit field whose ...