IPFYI
RFC 2404 Proposed Standard

The Use of HMAC-SHA-1-96 within ESP and AH

C. Madson, R. Glenn · 1998-11

Abstract

This document describes the use of the HMAC algorithm in conjunction with the SHA-1 algorithm as an authentication mechanism within the revised IPSEC Encapsulating Security Payload (ESP) and the Authentication Header (AH) protocols. HMAC-SHA-1-96 produces a 96-bit authenticator value that is truncated from a 160-bit HMAC-SHA-1 output.

Why This RFC Matters

RFC 2404 established HMAC-SHA-1-96 as a mandatory-to-implement integrity algorithm for IPsec, providing a standardized method for authenticating IP datagrams without encryption. By truncating the HMAC output to 96 bits, the specification balances security strength against the overhead added to each packet. This RFC formed a foundational building block for IPsec deployments throughout the 2000s and informed the design of later integrity transforms such as HMAC-SHA-256-128 defined in RFC 4868.

관련 프로토콜

IPSEC AH ESP

관련 용어

ipsec hmac authentication encryption vpn

Security에서 더 보기

RFC 3602 The AES-CBC Cipher Algorithm and Its Use with IPsec RFC 4253 The Secure Shell (SSH) Transport Layer Protocol RFC 4254 The Secure Shell (SSH) Connection Protocol RFC 4301 Security Architecture for the Internet Protocol RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 RFC 5280 Internet X.509 Public Key Infrastructure Certificate and CRL Profile RFC 6125 Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS) RFC 6454 The Web Origin Concept