RFC 2406           IP Encapsulating Security Payload       November 1998


3.2  Algorithms

   The mandatory-to-implement algorithms are described in Section 5,
   "Conformance Requirements".  Other algorithms MAY be supported.  Note
   that although both confidentiality and authentication are optional,
   at least one of these services MUST be selected hence both algorithms
   MUST NOT be simultaneously NULL.

3.2.1  Encryption Algorithms

   The encryption algorithm employed is specified by the SA.  ESP is
   designed for use with symmetric encryption algorithms.  Because IP
   packets may arrive out of order, each packet must carry any data
   required to allow the receiver to establish cryptographic
   synchronization for decryption.  This data may be carried explicitly
   in the payload field, e.g., as an IV (as described above), or the
   data may be derived from the packet header.  Since ESP makes
   provision for padding of the plaintext, encryption algorithms
   employed with ESP may exhibit either block or stream mode
   characteristics.  Note that since encryption (confidentiality) is
   optional, this algorithm may be "NULL".

3.2.2  Authentication Algorithms

   The authentication algorithm employed for the ICV computation is
   specified by the SA.  For point-to-point communication, suitable
   authentication algorithms include keyed Message Authentication Codes
   (MACs) based on symmetric encryption algorithms (e.g., DES) or on
   one-way hash functions (e.g., MD5 or SHA-1).  For multicast
   communication, one-way hash algorithms combined with asymmetric
   signature algorithms are appropriate, though performance and space
   considerations currently preclude use of such algorithms. Note that
   since authentication is optional, this algorithm may be "NULL".

3.3  Outbound Packet Processing

   In transport mode, the sender encapsulates the upper layer protocol
   information in the ESP header/trailer, and retains the specified IP
   header (and any IP extension headers in the IPv6 context).  In tunnel
   mode, the outer and inner IP header/extensions can be inter-related
   in a variety of ways.  The construction of the outer IP
   header/extensions during the encapsulation process is described in
   the Security Architecture document.  If there is more than one IPsec
   header/extension required by security policy, the order of the
   application of the security headers MUST be defined by security
   policy.






 
RFC 2406           IP Encapsulating Security Payload       November 1998


3.3.1  Security Association Lookup

   ESP is applied to an outbound packet only after an IPsec
   implementation determines that the packet is associated with an SA
   that calls for ESP processing.  The process of determining what, if
   any, IPsec processing is applied to outbound traffic is described in
   the Security Architecture document.

3.3.2  Packet Encryption

   In this section, we speak in terms of encryption always being applied
   because of the formatting implications.  This is done with the
   understanding that "no confidentiality" is offered by using the NULL
   encryption algorithm.  Accordingly, the sender:

       1. encapsulates (into the ESP Payload field):
               - for transport mode -- just the original upper layer
                 protocol information.
               - for tunnel mode -- the entire original IP datagram.
       2. adds any necessary padding.
       3. encrypts the result (Payload Data, Padding, Pad Length, and
          Next Header) using the key, encryption algorithm, algorithm
          mode indicated by the SA and cryptographic synchronization
          data (if any).
               - If explicit cryptographic synchronization data, e.g.,
                 an IV, is indicated, it is input to the encryption
                 algorithm per the algorithm specification and placed
                 in the Payload field.
               - If implicit cryptographic synchronication data, e.g.,
                 an IV, is indicated, it is constructed and input to
                 the encryption algorithm as per the algorithm
                 specification.

   The exact steps for constructing the outer IP header depend on the