Informally, if A and B share a secret key, K , for use with a cipher system, then if A creates a message where E is the encryption function, on receipt of c , B can decrypt c by computing . The message p is confidential if only A and B know K and . We will show under one circumstance integrity is needed over the message c , the source IP address and the SPI to guarantee confidentiality but that there is also a method for using encryption such that encryption can be used to imply integrity over c , the source IP address and the SPI.
Consider showing confidentiality over a group of fields, c , in an IP packet. Since the decryption key is retrieved from the security association table using the source IP address and SPI as an index, then integrity over these fields implies that the correct key, K , is gotten. If the ciphertext that is received has not been modified in transit and the correct key is used for decryption, then will be true. Therefore, under the assumption that the secret key is known only to the sender and receiver, if there is integrity over the message c , the source IP address and the SPI, then this guarantees confidentiality for the plaintext p . Indirectly, the plaintext is also authenticated. This is the method by which confidentiality is supplied using the current version of the ESP header including the optional authentication mechanism provided with that header.
aPrincipal RECEIVED datagram INTEGRITY (SRC datagram) security_association_table aPrincipal INTEGRITY (SPI datagram) security_association_table aPrincipal INTEGRITY message_field security_association_table aPrincipal isESPkey datagram k security_association_table message_field INDEXED_BY (encrypt-list datagram) --------------------------------------------- CONFID message_field security_association_table aPrincipal
Another possibility does not require integrity over the received data in order to prove confidentiality of the message but instead uses encryption and verification of correct decryption to imply integrity. Suppose that A and B share a secret key, K , and that A creates a message where x is an additional piece of information that the receiver knows or can calculate to verify that the message was correctly decrypted. On receipt of c , B can decrypt c by computing and then check that x is correct. The message px is confidential if only A and B know K, B either knows or can compute x , and . Two possibilities for the extra information x are: a second secret key K' shared only by A and B or an unkeyed hash of a part of p (a group of fields from an IP packet, before encryption is applied). In the case that x is a hash, the ability to recognize, by verifying the value of x , that the ciphertext was decrypted correctly implies that the correct key was used for decryption, hence for an IP packet the SPI and IP source address were not modified during transmission. Therefore, the plaintext is also authenticated.