ipsec

IPSec ESP pad length field


I'm currently learning about the IPSec protocol, but I don't understand how to find the pad length field at the receiver. It comes after the padding, which is encrypted (and thus has random values). Afterwards there is another random field (the integrity field). So how can find it in a deterministic way?


Solution

  • This is the diagram from RFC 4303:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ----
    |               Security Parameters Index (SPI)                 | ^Int.
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Cov-
    |                      Sequence Number                          | |ered
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ----
    |                    Payload Data* (variable)                   | |   ^
    ~                                                               ~ |   |
    |                                                               | |Conf.
    +               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Cov-
    |               |     Padding (0-255 bytes)                     | |ered*
    +-+-+-+-+-+-+-+-+               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |   |
    |                               |  Pad Length   | Next Header   | v   v
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ------
    |         Integrity Check Value-ICV   (variable)                |
    ~                                                               ~
    |                                                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    
                Figure 1.  Top-Level Format of an ESP Packet
    

    The pad length and the next header fields are both processed after decryption and the removal of the ICV. So as receiver you know exactly where these are located: at the end of the decrypted plaintext.