When ESP and AH are used together (ESP transport, AH transport) on the same packet does ESP encrypt the AH's hash, or is the hash left in the clear?
If the hash isn't encrypted, there are obviously security implications (like the AH not ensuring integrity of the authenticated information)
I ask because the AH precedes the ESP header, and ESP encryption in transport mode only applies to the TCP/UDP datagram following the ESP header (SPI and sequence).
I know that these are not commonly used together. That is not relevant. Also, I'm aware that ESP tunnel mode supports optional authentication (in a trailing segment after the message body) that's also not relevant here.