HP-UX IPSec Overview

Encapsulating Security Payload (ESP)

Nested ESP in AH

An ESP packet can be nested within an AH packet. For example, a 3DES-CBC ESP packet can be nested within an HMAC-MD5 packet. IPSec uses 3DES-CBC to build an ESP packet with the payload data encrypted using a symmetric key. IPSec then nests the ESP packet within an AH packet, using a second symmetric key. All the contents of the packet are authenticated, except the mutable fields of the IP header.

IPv6

The packet layouts and procedures for authenticated ESP and nested ESP in AH are the same for IPv6, except that the IP headers may include header extensions.

Figure 1-8

Nested ESP in AH

Chapter 1

37