'\" te
.\" Copyright (C) 2003, Sun Microsystems, Inc. All Rights Reserved
.TH ipsecesp 7P "18 May 2003" "SunOS 5.11" "Protocols"
.SH NAME
ipsecesp, ESP \- IPsec Encapsulating Security Payload
.SH SYNOPSIS
.LP
.nf
\fBdrv/ipsecesp\fR
.fi

.SH DESCRIPTION
.sp
.LP
The \fBipsecesp\fR module provides confidentiality, integrity, authentication, and partial sequence integrity (replay protection) to \fBIP\fR datagrams. The encapsulating security payload (\fBESP\fR) encapsulates its data, enabling it to protect data that follows in the datagram. For \fBTCP\fR packets, \fBESP\fR encapsulates the \fBTCP\fR header and its data only.  If the packet is an \fBIP\fR in \fBIP\fR datagram, \fBESP\fR protects the inner \fBIP\fR datagram. Per-socket policy allows "self-encapsulation" so \fBESP\fR can encapsulate \fBIP\fR options when necessary. See \fBipsec\fR(7P).
.sp
.LP
Unlike the authentication header (\fBAH\fR), \fBESP\fR allows multiple varieties of datagram protection. (Using a single datagram protection form can expose vulnerabilities.) For example, only \fBESP\fR can be used to provide confidentiality. But protecting confidentiality alone exposes vulnerabilities in both replay attacks and cut-and-paste attacks. Similarly, if \fBESP\fR protects only integrity and does not fully protect against eavesdropping, it may provide weaker protection than \fBAH\fR. See \fBipsecah\fR(7P).
.SS "ESP Device"
.sp
.LP
\fBESP\fR is implemented as a module that is auto-pushed on top of \fBIP\fR. Use the \fB/dev/ipsecesp\fR entry to tune \fBESP\fR with \fBndd\fR(1M).
.SS "Algorithms"
.sp
.LP
\fBESP\fRuses encryption and authentication algorithms. Authentication algorithms include HMAC-MD5 and HMAC-SHA-1. Encryption algorithms include DES, Triple-DES, Blowfish and AES. Each authentication and encryption algorithm contain key size and key format properties. You can obtain a list of authentication and encryption algorithms and their properties by using the \fBipsecalgs\fR(1M) command. You can also use the functions described in the \fBgetipsecalgbyname\fR(3NSL) man page to retrieve the properties of algorithms. Because of export laws in the United States, not all encryption algorithms are available outside of the United States.
.SS "Security Considerations"
.sp
.LP
\fBESP\fR without authentication exposes vulnerabilities to cut-and-paste cryptographic attacks as well as eavesdropping attacks. Like AH, \fBESP\fR is vulnerable to eavesdropping when used without confidentiality.
.SH ATTRIBUTES
.sp
.LP
See \fBattributes\fR(5) for descriptions of the following attributes:
.sp

.sp
.TS
tab() box;
cw(2.75i) |cw(2.75i) 
lw(2.75i) |lw(2.75i) 
.
ATTRIBUTE TYPEATTRIBUTE VALUE
_
Availabilitysystem/core-os
Interface StabilityCommitted
.TE

.SH SEE ALSO
.sp
.LP
\fBipsecalgs\fR(1M), \fBipsecconf\fR(1M), \fBndd\fR(1M), \fBattributes\fR(5), \fBgetipsecalgbyname\fR(3NSL), \fBip\fR(7P), \fBipsec\fR(7P), \fBipsecah\fR(7P)
.sp
.LP
Kent, S. and Atkinson, R.\fIRFC 2406, IP Encapsulating Security Payload (ESP)\fR, The Internet Society, 1998.