In the AH mode for IPsec, we include the IP header to ensure data origin authentication, and in the ESP, we exclude the IP header.

  1. what are the security properties we lose by not authenticating the IP address in the ESP mode?
  2. What security properties will we lose if we exclude port number authentication from ESP mode? The benefit would be that we would not have to worry about the NAT issues of IPsec if we exclude port numbers?

1 Answer 1


Using AH in any real-world setting is a horrible thing to do. You won't lose any security by using ESP instead of AH. In fact, ESP can provide all that you want from AH and more (confidentiality). You can secure an entire IP packet in a ESP tunnel mode which offers data origin guarantee too.

  • Are we going to lose any security properties, if we exclude the "port number" field out of the ESP?
    – tarun14110
    Jul 9, 2021 at 18:39
  • I'm not what you meant by excluding "port number" field out of ESP. ESP always takes the full L4 packet for its payload. So, how would you exclude port numbers from encryption? I don't think that's possible at all.
    – Fractal
    Jul 10, 2021 at 6:34
  • Yes! ESP takes the full L4 packet. But like AH excludes TTL from the IP packet, if we modify ESP to exclude port number what security issues we would have?
    – tarun14110
    Jul 11, 2021 at 18:06
  • I take it as a hypothetical question (since we can't change the standard) and the answer is None. NAT devices routinely does this (for source ports) and they actually depend on it (NAPT). That doesn't make any payload less secure or vulnerable. If you change the destination port, then the packet won't reach the target application.
    – Fractal
    Jul 11, 2021 at 19:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .