What Is AH? Security Definition

Think of AH as a tamper-evident seal on a package. When you send a package, you put a special seal that breaks if anyone opens or alters the package. The recipient can see that the seal is intact and know the package hasn't been tampered with.

However, the seal doesn't hide what's inside—anyone can still read the contents. Similarly, AH ensures that the data inside an IP packet hasn't been changed and that it came from the right sender, but it doesn't encrypt the data. So if you're sending a postcard with a tamper-evident sticker, the message is visible but you can prove it wasn't altered.

That's AH: it's about trust and integrity, not secrecy.

AH is defined in RFC 4302 (obsoletes RFC 2402) and operates at the network layer (Layer 3) of the OSI model. It is a component of the IPsec protocol suite. AH provides connectionless integrity, data origin authentication, and optional anti-replay protection.

It does not provide confidentiality (encryption). The AH header is inserted after the IP header and before the transport layer header (e.g., TCP/UDP). The AH header contains the following fields: Next Header (8 bits) – indicates the type of the next payload; Payload Length (8 bits) – length of AH in 32-bit words minus 2; Reserved (16 bits) – must be zero; Security Parameters Index (SPI) (32 bits) – identifies the security association; Sequence Number (32 bits) – monotonically increasing counter for anti-replay; Integrity Check Value (ICV) (variable) – cryptographic checksum over the packet (including immutable IP header fields).

AH authenticates the entire IP packet, including fields in the IP header that do not change in transit (e.g., source/destination IP, protocol). Fields that change (like TTL, header checksum) are set to zero before ICV calculation.

AH can be used in transport mode (protects payload and selected IP header fields) or tunnel mode (protects entire original IP packet, including original IP header). Compared to ESP, AH authenticates more of the packet (including outer IP header in tunnel mode) but does not encrypt. In modern IPsec implementations, ESP with null encryption is often preferred over AH because it can also provide authentication and can traverse NAT more easily.

AH is not compatible with NAT because NAT modifies the IP header, which breaks AH's integrity check.

Understanding AH is critical for IT professionals because it is a fundamental building block of IPsec, which is widely used for secure VPNs and site-to-site communications. AH provides a way to ensure data integrity and authenticity without the overhead of encryption, which is important in environments where encryption is already provided by other means or where performance is a concern. Troubleshooting IPsec issues often involves understanding whether AH or ESP is in use, as AH is incompatible with NAT and can cause connectivity problems in NAT environments.

Knowledge of AH helps in designing secure networks, selecting appropriate security protocols, and diagnosing authentication failures. For career growth, expertise in IPsec and its components like AH is expected for network engineers, security analysts, and anyone pursuing CompTIA Network+, Security+, or CCNA certifications.

Exam questions often present a scenario where a network administrator needs to ensure data integrity and authentication but not encryption. The correct answer is AH. Another pattern: 'Which IPsec protocol is incompatible with NAT?'

– the answer is AH because NAT changes the IP header, breaking the ICV. A third pattern: 'Which IPsec protocol provides anti-replay protection?' – both AH and ESP can provide anti-replay, but the question may specify 'without encryption,' leading to AH.

A fourth pattern: 'In IPsec transport mode, which parts of the packet are authenticated by AH?' – the answer is the payload and selected IP header fields (immutable). Wrong answers often include ESP (which provides encryption), SSL/TLS (which operates at higher layers), or confusing AH with authentication headers in other contexts.

To spot the correct answer, look for keywords like 'integrity only,' 'no encryption,' 'authentication without confidentiality,' or 'NAT incompatibility.'

Core Concept: AH is an IPsec protocol that provides data integrity, data origin authentication, and optional anti-replay protection for IP packets. It does not encrypt the payload. How it works: When a packet is sent using AH, an AH header is inserted between the IP header and the transport layer header.

The AH header contains a Security Parameters Index (SPI) to identify the security association, a sequence number for anti-replay, and an Integrity Check Value (ICV) that is a cryptographic hash computed over the entire IP packet (including immutable fields in the IP header). The receiving end recalculates the ICV and compares it to the one in the AH header. If they match, the packet is authentic and unchanged.

Comparison to similar technologies: ESP (Encapsulating Security Payload) also provides integrity and authentication but additionally offers encryption (confidentiality). ESP can also provide authentication alone (ESP with null encryption), which sometimes makes AH redundant. However, AH authenticates more of the packet (including outer IP header in tunnel mode) than ESP does.

SSL/TLS operates at the transport layer and provides encryption and authentication for specific applications, not for all IP traffic. Key takeaway: AH is used when you need to guarantee that a packet hasn't been altered and comes from a trusted source, but you don't need to hide the data. Remember that AH is not compatible with NAT because NAT changes the IP header, breaking the integrity check.

In modern networks, ESP with null encryption is often preferred over AH because it can traverse NAT more easily.