GSEC · Question #253
What does Authentication Header (AH) add to the packet in order to prevent an attacker from lying about the source?
The correct answer is A. Integrity Check Value. AH uses an Integrity Check Value (ICV) computed over packet headers to authenticate the source and detect tampering, preventing source address spoofing.
Question
What does Authentication Header (AH) add to the packet in order to prevent an attacker from lying about the source?
Options
- AIntegrity Check Value
- BAES-128 encryption
- CTriple DES encryption
- D32-bit sequence number
How the community answered
(25 responses)- A84% (21)
- B8% (2)
- C4% (1)
- D4% (1)
Why each option
AH uses an Integrity Check Value (ICV) computed over packet headers to authenticate the source and detect tampering, preventing source address spoofing.
AH computes an Integrity Check Value (ICV) using a keyed hash such as HMAC-MD5 or HMAC-SHA1 over packet header fields, including the source IP address. Because an attacker cannot reproduce a valid ICV without knowing the shared secret, they cannot forge the source address undetected. This cryptographic binding of the ICV to header fields is the core anti-spoofing mechanism provided by AH.
AES-128 is a symmetric encryption algorithm used for confidentiality in ESP, not a feature of AH, which provides no encryption.
Triple DES is an encryption algorithm associated with ESP confidentiality, not with AH, which does not perform any encryption.
The 32-bit sequence number in AH is used to prevent replay attacks, not to authenticate the packet source or prevent source spoofing.
Concept tested: IPsec AH Integrity Check Value and source authentication
Source: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc739412(v=ws.10)
Topics
Community Discussion
No community discussion yet for this question.