ipsecah(7P)							     Protocols							       ipsecah(7P)

NAME

       ipsecah, AH - IPsec Authentication Header

SYNOPSIS

       drv/ipsecah

DESCRIPTION

       The  ipsecah module (AH) provides strong integrity,  authentication, and partial sequence integrity (replay protection) to IP datagrams. AH
       protects the parts of the IP datagram that can be predicted by the sender as it will be received by the receiver. For example, the  IP  TTL
       field is not a predictable field, and is not protected by AH.

       AH  is inserted between the IP header and the transport header. The transport header can be  TCP,  UDP, ICMP, or another IP header, if tun-
       nels are  being used. See tun(7M).

   AH Device
       AH is implemented as a module that is auto-pushed on top of IP. The entry /dev/ipsecah is used for tuning AH with ndd(1M).

   Authentication Algorithms
       Current authentication algorithms supported include HMAC-MD5 and HMAC-SHA-1. Each authentication algorithm has its own  key  size  and  key
       format properties. You can obtain a list of authentication algorithms and their properties by using the ipsecalgs(1M) command. You can also
       use the functions described in the getipsecalgbyname(3NSL) man page to retrieve the properties of algorithms.

   Security Considerations
       Without replay protection enabled, AH is vulnerable to replay attacks. AH does not protect against eavesdropping. Data  protected  with	AH
       can still be seen by an adversary.

ATTRIBUTES

       See attributes(5)  for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       +-----------------------------+-----------------------------+
       |Availability		     |SUNWcsr			   |
       +-----------------------------+-----------------------------+
       |Interface Stability	     |Evolving			   |
       +-----------------------------+-----------------------------+

SEE ALSO

       ipsecalgs(1M), ipsecconf(1M), ndd(1M), attributes(5), getipsecalgbyname(3NSL), tun(7M), ip(7P), ipsec(7P), ipsecesp(7P)

       Kent, S. and Atkinson, R.RFC 2402, IP Authentication Header, The Internet Society, 1998.

SunOS 5.10							    20 May2003							       ipsecah(7P)