RFC 1826 (rfc1826) - Page 2 of 13

IP Authentication Header

RFC 1826                IP Authentication Header             August 1995


   "fragment offset", or "routing pointer") are considered to be zero
   for the calculation of the authentication data.  This provides
   significantly more security than is currently present in IPv4 and
   might be sufficient for the needs of many users.

   Use of this specification will increase the IP protocol processing
   costs in participating end systems and will also increase the
   communications latency.  The increased latency is primarily due to
   the calculation of the authentication data by the sender and the
   calculation and comparison of the authentication data by the receiver
   for each IP datagram containing an Authentication Header.  The impact
   will vary with authentication algorithm used and other factors.

   In order for the Authentication Header to work properly without
   changing the entire Internet infrastructure, the authentication data
   is carried in its own payload.  Systems that aren't participating in
   the authentication MAY ignore the Authentication Data.  When used
   with IPv6, the Authentication Header is normally placed after the
   Fragmentation and End-to-End headers and before the ESP and
   transport-layer headers.  The information in the other IP headers is
   used to route the datagram from origin to destination.  When used
   with IPv4, the Authentication Header immediately follows an IPv4
   header.

   If a symmetric authentication algorithm is used and intermediate
   authentication is desired, then the nodes performing such
   intermediate authentication would need to be provided with the
   appropriate keys.  Possession of those keys would permit any one of
   those systems to forge traffic claiming to be from the legitimate
   sender to the legitimate receiver or to modify the contents of
   otherwise legitimate traffic.  In some environments such intermediate
   authentication might be desirable [BCCH94].  If an asymmetric
   authentication algorithm is used and the routers are aware of the
   appropriate public keys and authentication algorithm, then the
   routers possessing the authentication public key could authenticate
   the traffic being handled without being able to forge or modify
   otherwise legitimate traffic.  Also, Path MTU Discovery MUST be used
   when intermediate authentication of the Authentication Header is
   desired and IPv4 is in use because with this method it is not
   possible to authenticate a fragment of a packet [MD90] [Kno93].











Atkinson                    Standards Track