Comparison of Authentication Header Protocol and Encapsulation Security Payload Protocol

For virtual private networks (VPNs), the term authentication header (AH) protocol represents an internet protocol security (IPsec) subset that authenticates the sender to the receiver and helps to authenticate the message passed between these parties. As a result, it helps to validate the integrity of the message as well as its sender, thereby proving that the message originated from the recorded sender. According to Snader (2015), this also requires the hashing of each packet’s payload along with the header and does not perform any encryption on the sent data.

Unlike the AH IPsec protocol, the encapsulation security payload (ESP) provides an alternative that can assure senders and receivers of the integrity, authenticity, and confidentiality of their communications (Snader, 2015). This protocol achieves granular security for communications since aside from authenticating the sender as AH does, it also encrypts the transferred data to improve the confidentiality of the transfer. Moreover, ESP can also achieve the same authentication as AH even as it authenticates the IP datagram as a means of determining the validity of the sender’s identity rather than authenticating the entire packet.

Both AH and ESP IPsec make communications between devices more secure but it is also evident that ESP provides better coverage of confidentiality needs due to its encryption capabilities. One use case of both protocols in tandem is troubleshooting communication issues, whereby the use of AH helps to determine whether a connection between the communicating devices actually exists (Snader, 2015). However, the fact that AH also hashes the IP section of the packet invalidates its use in network address translation (NAT) setups since the change in sender would automatically invalidate all packets routed through such a network.

References

Snader, J. C. (2015). VPNs Illustrated: Tunnels, VPNs, and IPsec: Tunnels, VPNs, and IPsec. Addison-Wesley Professional.