Choosing Between AH and ESP

Choosing Between AH and ESP

Deciding to use AH or ESP in a particular situation might seem confusing, but remember these two basics: any time more services are required, you can expect additional resources will be consumed. The same can be expected of throughput so, if a service isn’t needed, don’t use it. Follow both of these rules:

• If you need to make sure that data from an authenticated source is transferred with integrity, but confidentiality isn’t necessary, then use the AH protocol. This saves the additional overhead and bandwidth associated with ESP encryption.

• If data confidentiality (privacy through encryption) is required, then ESP must be used. ESP can provide authentication and integrity for the packets via the same algorithms used by AH.