GSEC · Question #29
Which of the following fields CANNOT be hashed by Authentication Header (AH) in transport mode?
The correct answer is C. TTL. AH cannot hash mutable IP header fields that change during transit; TTL is decremented by each router and therefore excluded from AH integrity checks.
Question
Which of the following fields CANNOT be hashed by Authentication Header (AH) in transport mode?
Options
- ALength
- BSource IP
- CTTL
- DDestination IP
How the community answered
(36 responses)- A6% (2)
- B14% (5)
- C78% (28)
- D3% (1)
Why each option
AH cannot hash mutable IP header fields that change during transit; TTL is decremented by each router and therefore excluded from AH integrity checks.
The IP header Length field is immutable and does not change during transit, so AH can safely include it in the hash.
Source IP is an immutable field in normal unicast routing and is covered by AH's integrity check.
TTL is a mutable field - each router hop decrements it by 1, meaning the hash computed at the source would never match the hash verified at the destination. AH explicitly excludes mutable fields like TTL, TOS, and Header Checksum from its integrity calculation to prevent false authentication failures in transit.
Destination IP is immutable for a given packet's journey and is included in AH's hash calculation.
Concept tested: IPsec AH mutable vs immutable header fields
Source: https://datatracker.ietf.org/doc/html/rfc4302
Topics
Community Discussion
No community discussion yet for this question.