A component of the IPsec protocol suite, the Authentication Header (AH) provides connectionless integrity, data origin authentication, and optional anti-replay protection for IP packets. Unlike encryption protocols, AH does not hide the contents of the packet’s payload; instead, it ensures that the data has not been altered in transit and that it originates from a trusted source.
How AH Works
AH works by adding a header to the IP packet that contains authentication information generated using a shared secret key and a cryptographic hash function, typically through mechanisms like HMAC combined with SHA-1 or SHA-2. This header covers most of the IP packet, including portions of the IP header itself, so that any unauthorized changes are detectable.
- Transport mode: Authenticates only the payload and certain header fields.
- Tunnel mode: Authenticates the entire IP packet within a new IP header, typically for network-to-network VPNs.
Use Cases
Because AH does not encrypt data, it is often used in scenarios where confidentiality is not required but integrity and authentication are critical. However, in many practical deployments, Encapsulating Security Payload (ESP) is preferred, as it can provide both encryption and authentication, making AH less common in modern IPsec configurations.
IPsec Context
Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts packets of data to provide secure encrypted communication between two computers over an Internet Protocol network. It is used in virtual private networks (VPNs). IPsec includes protocols for establishing mutual authentication between agents at the beginning of a session and negotiation of cryptographic keys to use during the session. IPsec can protect data flows between a pair of hosts (host-to-host), between a pair of security gateways (network-to-network), or between a security gateway and a host (network-to-host). IPsec uses cryptographic security services to protect communications over Internet Protocol (IP) networks. It supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and protection from replay attacks.