Q

Authentication Header vs. IKE

In this Ask the Expert Q&A, Joel Dubin discusses how and when the Authentication Header encryption protocol is used.

Do we still need an Authentication Header if the Internet Key Exchange negotiates IPSec protections and the related secret key, binding participants' addresses to the keys, effectively authenticating these critical IP header fields?
There are two different things going on here. One is a key exchange and the other a data encryption protocol. IPSec consists of both a way to securely exchange cryptographic keys and then to transmit data securely over the Internet. The Internet Key Exchange (IKE) is the protocol for the key exchange and Authentication Header (AH) is one of the two encryption protocols.

IKE is used to set up the IPSec conversation and exchange the keys needed for encrypting the data through its secure tunnel. AH and Encapsulating Security Payload (ESP) are the two ways the data is encrypted after the keys are exchanged. Once IKE exchanges the keys, one of the two encryption protocols -- AH or ESP -- must be used. AH just authenticates the TCP packet without encrypting it, while ESP is stronger in that it both authenticates...

and encrypts the packet. So, AH may still be needed if it's the encryption protocol of choice over ESP in the IPSec set up. Is it still used? Not as much as ESP. There has been talk from time to time of deprecating AH, but it still hasn't been officially removed from any RFP about IPSec.

Though less secure than ESP, AH requires less processor power and is obviously less of a strain on the network. But, besides being less secure, it also can't be used for connecting outside a network using NAT. Despite these weaknesses, if the security risk is low behind a NATed firewall or router, and efficiency is paramount, AH can still be used in an internal network.


More information
  • Visit our resource center and learn more about authentication systems and protocols.
  • Learn how to secure public key transport to transmit data security over the Internet.

  • This was first published in November 2005

    Dig deeper on Email Security Guidelines, Encryption and Appliances

    Pro+

    Features

    Enjoy the benefits of Pro+ membership, learn more and join.

    Have a question for an expert?

    Please add a title for your question

    Get answers from a TechTarget expert on whatever's puzzling you.

    You will be able to add details on the next page.

    0 comments

    Oldest 

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to:

    -ADS BY GOOGLE

    SearchCloudSecurity

    SearchNetworking

    SearchCIO

    SearchConsumerization

    SearchEnterpriseDesktop

    SearchCloudComputing

    ComputerWeekly

    Close