Re: [IPsec] IPSec, ESP and AH authentication

At 6:26 AM -0700 10/9/07, Tjeu wrote:
>Dear All,
>
>As you might know, IPSec ESP authentication does not authenticate the
>destination and source
>addresses of the IP header, whereas the IPSec AH authentication does(i.e.
>calculatec MAC over them). However, both claim that they offer data origin
>authentication. It is not clear for me how the ESP authentication offers
>data origin authentication, as the MAC is not computed on the source and
>dest addresses. Therefore the attacker could easily modify them. Am I
>missing something ? I would be thankful if anyone could provide links where
>I could read regarding this subject, in more details. I looked through some
>RFC's but they dont seem to help.
>
>
>Thanks,
>
>Tjeu
>--

IPsec ESP does provide data origin authentication.  Maybe IPSec doesn't :-).

(Note the correct spelling of the architecture.)

Steve

_______________________________________________
IPsec mailing list
IPsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec