5. ESP header

The ESP (Encapsulating Security Payload) header ensures not only the confidentiality of IP packets, but also the confidentiality of flows, the latter guaranteeing that even a statistical analysis of the flows exchanged (volume, frequency, etc.) will not lead to any deductions as to the content of the exchanges. Just as the authentication header does, the ESP header can prove the integrity of packets and the identity of their sender. The authenticator can optionally detect packet replay. Unlike AH, ESP actually encapsulates all the fields to be protected, which justifies the E (Encapsulating) in ESP.

To provide all these security services, it is necessary to encrypt the data to be protected, smooth the traffic to thwart any statistical analysis, calculate an authenticator and encapsulate this information in the ESP header.