What is IPsec ESP vs AH, and when is each used?

• A. ESP provides confidentiality, integrity, and origin authentication; AH provides integrity and authentication but no encryption; ESP is more commonly used.
• B. ESP provides confidentiality only.
• C. AH provides encryption.
• D. ESP and AH are obsolete.

Answer: (A)

IPsec is built around two mechanisms, ESP and AH, and the key difference is encryption. ESP protects the payload by encrypting it, and it can also provide data integrity and origin authentication for what it carries (typically the encrypted payload and ESP trailer) using an authentication tag. AH, on the other hand, offers integrity and origin authentication for the entire packet but does not encrypt the payload, so no confidentiality is provided. Because protecting the actual contents is usually the primary security need in networks and VPNs, ESP is the standard choice and is used much more widely. AH is reserved for situations where you only want to guard integrity and authenticity without encryption, though NAT and other network behaviors can complicate its use.