RFC 1826 (rfc1826) - Page 2 of 13
IP Authentication Header
Alternative Format: Original Text Document
RFC 1826 IP Authentication Header August 1995
"fragment offset", or "routing pointer") are considered to be zero
for the calculation of the authentication data. This provides
significantly more security than is currently present in IPv4 and
might be sufficient for the needs of many users.
Use of this specification will increase the IP protocol processing
costs in participating end systems and will also increase the
communications latency. The increased latency is primarily due to
the calculation of the authentication data by the sender and the
calculation and comparison of the authentication data by the receiver
for each IP datagram containing an Authentication Header. The impact
will vary with authentication algorithm used and other factors.
In order for the Authentication Header to work properly without
changing the entire Internet infrastructure, the authentication data
is carried in its own payload. Systems that aren't participating in
the authentication MAY ignore the Authentication Data. When used
with IPv6, the Authentication Header is normally placed after the
Fragmentation and End-to-End headers and before the ESP and
transport-layer headers. The information in the other IP headers is
used to route the datagram from origin to destination. When used
with IPv4, the Authentication Header immediately follows an IPv4
header.
If a symmetric authentication algorithm is used and intermediate
authentication is desired, then the nodes performing such
intermediate authentication would need to be provided with the
appropriate keys. Possession of those keys would permit any one of
those systems to forge traffic claiming to be from the legitimate
sender to the legitimate receiver or to modify the contents of
otherwise legitimate traffic. In some environments such intermediate
authentication might be desirable [BCCH94]. If an asymmetric
authentication algorithm is used and the routers are aware of the
appropriate public keys and authentication algorithm, then the
routers possessing the authentication public key could authenticate
the traffic being handled without being able to forge or modify
otherwise legitimate traffic. Also, Path MTU Discovery MUST be used
when intermediate authentication of the Authentication Header is
desired and IPv4 is in use because with this method it is not
possible to authenticate a fragment of a packet [MD90] [Kno93].
Atkinson Standards Track