Subject: [Ipsec] ESP Vs AH integrity

From: "Vishwas Manral" <[email-masked]>
Date: Sun, 18 Dec 2005 23:20:26 -0800

Hi,
 
Various IPsec drafts state that: -
   The primary difference between the integrity
   provided by ESP and AH is the extent of the coverage.  Specifically,
   ESP does not protect any IP header fields unless those fields are

      encapsulated by ESP.

I think one more difference between ESP integrity-only service and AH is
that, in case of AH the packet after the AH can be further looked into
by any middle-box while the ESP integrity only may not be. The ESP
header does not have to say integrity only service in the packet itself.

Is my understanding correct?

Thanks,

Vishwas

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec