IKE is used to set up the IPSec conversation and exchange the keys needed for encrypting the data through its secure tunnel. AH and Encapsulating Security Payload (ESP) are the two ways the data is encrypted after the keys are exchanged. Once IKE exchanges the keys, one of the two encryption protocols -- AH or ESP -- must be used. AH just authenticates the TCP packet without encrypting it, while ESP is stronger in that it both authenticates and encrypts the packet. So, AH may still be needed if it's the encryption protocol of choice over ESP in the IPSec set up. Is it still used? Not as much as ESP. There has been talk from time to time of deprecating AH, but it still hasn't been officially removed from any RFP about IPSec.
Though less secure than ESP, AH requires less processor power and is obviously less of a strain on the network. But, besides being less secure, it also can't be used for connecting outside a network using NAT. Despite these weaknesses, if the security risk is low behind a NATed firewall or router, and efficiency is paramount, AH can still be used in an internal network.
Dig Deeper on Email and Messaging Threats-Information Security Threats
Related Q&A from Joel Dubin
Learn about the purpose of CAPTCHA challenges that enable websites to differentiate bots from authentic users to stop spammers from hijacking forums ... Continue Reading
Proper planning is at the top of the list for single sign-on best practices, but it's important to get enterprise SSO implementations off to a good ... Continue Reading
After a server room door has been compromised, finding a more secure solution is of utmost importance. Learn how to choose a server room door that ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.