DataTerminology.comNEW
Also known as: AH
An IPsec protocol providing connectionless integrity and data origin authentication for IP packets.
DESCRIPTION
Authentication Header (AH) is an IPsec component that authenticates IP packets and ensures integrity using keyed hashes, optionally protecting against replay attacks. Unlike ESP, AH does not provide confidentiality, and authenticates immutable IP header fields. It can operate in transport or tunnel mode. AH is standardized in RFCs and used in secure networking scenarios where integrity and source authentication are required without encryption overhead.
ALTERNATIVE DEFINITIONS
IETF RFC 4302
The IP Authentication Header (AH) provides connectionless integrity, data origin authentication, and an optional anti-replay service.
Authoritative standard emphasizing integrity and authentication, not confidentiality.
Cisco
Authentication Header (AH) is an IPsec protocol that provides data origin authentication, connectionless integrity, and protection against replay attacks.
Vendor explanation focusing on practical deployment and features.
RELATED TERMS
IPsec Protocol Suite HMAC Integrity Anti-replay IKE Transport Mode Tunnel Mode Packet Authentication
COMPETING TERMS
Encapsulating Security Payload
RELATIONS
- Broader: Header IPsec Protocol Suite
KNOWLEDGE AREAS
Data Security Infrastructure Software Engineering Cloud
TARGET AUDIENCE
Cybersecurity Engineer Security Architect Chief Information Security Officer DevOps Engineer Cloud Architect
EXTERNAL SOURCES
- Wikipedia - Authentication Header
- IETF - Standard defining IP Authentication Header
- IETF - Security architecture for IP including AH/ESP
- Microsoft Learn - Overview of IPsec components and modes
TOP QUESTIONS
When should I use Authentication Header instead of ESP?
Use AH when you need authentication and integrity without encryption, or when authenticating immutable header fields is required.
Category: Opinion
What is a common mistake when configuring AH?
Assuming AH provides confidentiality. It does not encrypt payloads; combine with ESP if encryption is required.
Category: Mistakes
How does AH prevent replay attacks?
AH includes sequence numbers and optional anti-replay checks to detect and reject duplicate packets.
Category: Example
Does AH work with NAT?
AH struggles with NAT because it authenticates IP headers. ESP in tunnel mode is typically preferred in NATed environments.
Category: Risks
What cryptographic primitives are used with AH?
HMAC variants (e.g., HMAC-SHA) with shared keys provide integrity and authentication for packets.
Category: Requirements
Is AH widely deployed today?
ESP is more common due to confidentiality needs and NAT compatibility, but AH remains relevant in specific integrity-focused contexts.
Category: Relevancy
How do transport and tunnel modes affect AH?
Transport mode protects payloads between hosts; tunnel mode protects encapsulated packets between gateways or host-gateway pairs.
Category: Example
How is key management handled for AH?
Typically via IKE/IKEv2 to negotiate security associations and keys used for authentication.
Category: Management
What logging should I enable for AH troubleshooting?
Log SA negotiations, sequence numbers, and integrity check failures. Packet captures verify AH headers and hashes.
Category: Management