1

I'm reading about security associations. I've understood that a SA is a virtual connection between a client and a sever, in which all the security parameters, such as encryption algorithm, IP origin and source HMAC algorithm... are defined.

My question is: Is SA implemented when using AH and ESP protocols, or only in ESP when confidentiality is required?

And there goes another question: How does the router know whether to use IPsec or not? By using the protocol field in the IP header?

2

My question is: Is SA implemented when using AH and ESP protocols, or only in ESP when confidentiality is required?

SA is also required in AH. To quote RFC 4302:

3.3.1. Security Association Lookup

AH is applied to an outbound packet only after an IPsec implementation determines that the packet is associated with an SA that calls for AH processing.

There's no AH unless the SA says so; therefore AH requires an SA.

How does the router know whether to use IPsec or not? By using the protocol field in the ip header?

Correct, IPSec runs over IP protocols 50 (ESP) and 51 (AH), as opposed to protocol 6 (TCP) or 17 (UDP) for more normal traffic.

More information about Security Associations and IP Traffic Processing can be found in the Security Architecture document, RFC 4301. For example, section 4.1 of that document reiterates that AH requires SA in a more roundabout way:

Security services are afforded to an SA by the use of AH, or ESP, but not both. If both AH and ESP protection are applied to a traffic stream, then two SAs must be created and coordinated to effect protection through iterated application of the security protocols.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.