RFC 2402                IP Authentication Header           November 1998


3.3.3.1.1  ICV Computation for IPv4

3.3.3.1.1.1  Base Header Fields

   The IPv4 base header fields are classified as follows:

   Immutable
             Version
             Internet Header Length
             Total Length
             Identification
             Protocol (This should be the value for AH.)
             Source Address
             Destination Address (without loose or strict source routing)

   Mutable but predictable
             Destination Address (with loose or strict source routing)

   Mutable (zeroed prior to ICV calculation)
             Type of Service (TOS)
             Flags
             Fragment Offset
             Time to Live (TTL)
             Header Checksum

      TOS -- This field is excluded because some routers are known to
             change the value of this field, even though the IP
             specification does not consider TOS to be a mutable header
             field.

      Flags -- This field is excluded since an intermediate router might
             set the DF bit, even if the source did not select it.

      Fragment Offset -- Since AH is applied only to non-fragmented IP
             packets, the Offset Field must always be zero, and thus it
             is excluded (even though it is predictable).

      TTL -- This is changed en-route as a normal course of processing
             by routers, and thus its value at the receiver is not
             predictable by the sender.

      Header Checksum -- This will change if any of these other fields
             changes, and thus its value upon reception cannot be
             predicted by the sender.








 
RFC 2402                IP Authentication Header           November 1998


3.3.3.1.1.2  Options

   For IPv4 (unlike IPv6), there is no mechanism for tagging options as
   mutable in transit.  Hence the IPv4 options are explicitly listed in
   Appendix A and classified as immutable, mutable but predictable, or
   mutable.  For IPv4, the entire option is viewed as a unit; so even
   though the type and length fields within most options are immutable
   in transit, if an option is classified as mutable, the entire option
   is zeroed for ICV computation purposes.

3.3.3.1.2  ICV Computation for IPv6

3.3.3.1.2.1  Base Header Fields

   The IPv6 base header fields are classified as follows:

   Immutable
             Version
             Payload Length
             Next Header (This should be the value for AH.)
             Source Address
             Destination Address (without Routing Extension Header)

   Mutable but predictable
             Destination Address (with Routing Extension Header)

   Mutable (zeroed prior to ICV calculation)
             Class
             Flow Label
             Hop Limit

3.3.3.1.2.2  Extension Headers Containing Options

   IPv6 options in the Hop-by-Hop and Destination Extension Headers