Tribblix: manual page: ipsecesp.4p

IPSECESP(4P) Protocols IPSECESP(4P)

NAME

ipsecesp, ESP - IPsec Encapsulating Security Payload

SYNOPSIS

drv/ipsecesp

DESCRIPTION

The ipsecesp module provides confidentiality, integrity,
authentication, and partial sequence integrity (replay protection) to
IP datagrams. The encapsulating security payload (ESP) encapsulates
its data, enabling it to protect data that follows in the datagram.
For TCP packets, ESP encapsulates the TCP header and its data only.
If the packet is an IP in IP datagram, ESP protects the inner IP
datagram. Per-socket policy allows "self-encapsulation" so ESP can
encapsulate IP options when necessary. See ipsec(4P).

Unlike the authentication header (AH), ESP allows multiple varieties
of datagram protection. (Using a single datagram protection form can
expose vulnerabilities.) For example, only ESP can be used to provide
confidentiality. But protecting confidentiality alone exposes
vulnerabilities in both replay attacks and cut-and-paste attacks.
Similarly, if ESP protects only integrity and does not fully protect
against eavesdropping, it may provide weaker protection than AH. See
ipsecah(4P).

ESP Device

ESP is implemented as a module that is auto-pushed on top of IP. Use
the /dev/ipsecesp entry to tune ESP with ndd(8).

Algorithms

ESPuses encryption and authentication algorithms. Authentication
algorithms include HMAC-MD5 and HMAC-SHA-1. Encryption algorithms
include DES, Triple-DES, Blowfish and AES. Each authentication and
encryption algorithm contain key size and key format properties. You
can obtain a list of authentication and encryption algorithms and
their properties by using the ipsecalgs(8) command. You can also use
the functions described in the getipsecalgbyname(3NSL) man page to
retrieve the properties of algorithms. Because of export laws in the
United States, not all encryption algorithms are available outside of
the United States.

Security Considerations

ESP without authentication exposes vulnerabilities to cut-and-paste
cryptographic attacks as well as eavesdropping attacks. Like AH, ESP
is vulnerable to eavesdropping when used without confidentiality.

ATTRIBUTES