What is the difference between AH and ESP?
Show the answer
Say this first
Both protect IP packets. AH (IP protocol 51) gives integrity and origin authentication over the whole packet, including the fields of the outer IP header that do not change in transit, but it does not encrypt. ESP (IP protocol 50) encrypts and authenticates, but its integrity check does not cover the outer IP header. Because AH signs the addresses, any NAT breaks it. Practically every deployment uses ESP.
Go deeper
ESP packet layout
| Field | Size |
|---|---|
| SPI | 4 bytes |
| Sequence number | 4 bytes |
| IV | 16 bytes for AES-CBC, 8 for AES-GCM |
| Payload | the protected packet or segment |
| Padding | 0 to 255 bytes, to fill the cipher block |
| Pad length and next header | 2 bytes |
| ICV (integrity check) | 12 bytes for HMAC-SHA1-96, 16 for HMAC-SHA-256-128 and GCM |
Everything from the payload through the next header field is encrypted. The SPI and sequence number are in clear because the receiver needs them to find the SA.
Why AH is rare
- No confidentiality.
- NAT rewrites the source address, so the AH check fails.
- If you ever need integrity without encryption, ESP with a null cipher does that and survives NAT traversal.
They will ask next
Can AH and ESP be used together?
Yes, a transform set can bundle both, which was once done to protect the outer header as well. It adds overhead and NAT problems and gives nothing that ESP with strong integrity does not. I would not deploy it.
Why is AES-GCM preferred for ESP?
It is an AEAD cipher: it encrypts and authenticates in one pass, so there is no separate HMAC. It is fast in hardware and has less overhead (8-byte IV). On IOS it is
esp-gcm 256in the transform set, with no separate integrity transform.
Traps
- Saying AH and ESP use port 51 and port 50. They are IP protocol numbers. Only with NAT-T is ESP put inside UDP 4500.
- Saying ESP authenticates the entire packet. In tunnel mode it covers the original packet, not the new outer header.