data origin authentication

[Goeman Stefan <[e-mail]>]

Hello All,

In rfc 2406 "IP Encapsulating Security Payload", and also in
draft-ietf-ipsec-esp-v3-02.txt,
I read: "EPS is used to provide confidentiality, data origin authentication,
connectionless integrity,
an anti-replay service (a form of partial sequence integrity), and limited
traffic flow confidentiality.
The set of services provided depends on options selected at the time of
Security Association (SA)
establishment and on the location of the implementation in a network
topology."

I have been reading more carefully through the rfc (not through the draft
yet). I is correct to say
that if ESP is used in transport mode, there is no data origin
authentication? I would say this because
the IP header, containing the source IP address is not authenticated.
Or am I missing something here?


Greetings,

Stefan.