Which IPsec protocol is used to encrypt the data payload?

The Encapsulating Security Payload (ESP) protocol is a core component of the IPsec suite designed to provide confidentiality for data. It achieves this by encrypting the IP packet's payload. In addition to encryption, ESP can also optionally provide data origin authentication, connectionless integrity, and anti-replay services. The primary function that distinguishes ESP from other IPsec protocols like Authentication Header (AH) is its ability to encrypt the data, thus ensuring it remains confidential during transit across the network.

B. IKE: Internet Key Exchange (IKE) is a control plane protocol used to negotiate security associations (SAs) and cryptographic keys; it does not encrypt the actual data payload.

C. AH: The Authentication Header (AH) protocol provides authentication and integrity for the entire IP packet but does not offer any encryption or confidentiality for the payload.

D. TCP: The Transmission Control Protocol (TCP) is a transport layer protocol responsible for reliable data delivery and is not part of the IPsec suite for security functions.

1. Juniper Networks Documentation: "IPsec Overview". This document states

"Encapsulating Security Payload (ESP)—Provides confidentiality

data origin authentication

connectionless integrity

an anti-replay service

and limited traffic flow confidentiality by encrypting the payload."

URL: https://www.juniper.net/documentation/us/en/software/junos/vpn-ipsec/topics/concept/ipsec-overview.html

2. Internet Engineering Task Force (IETF) RFC 4303: "IP Encapsulating Security Payload (ESP)". The abstract and introduction (Section 1) define ESP's primary role: "ESP is used to provide confidentiality

data origin authentication

connectionless integrity

an anti-replay service...".

URL: https://datatracker.ietf.org/doc/html/rfc4303

3. University of California

Berkeley - CS 161 Courseware: "Lecture 18: Network Security II". The lecture notes clearly differentiate the protocols: "ESP (Encapsulating Security Payload) provides confidentiality and integrity... AH (Authentication Header) provides integrity only."

URL: https://inst.eecs.berkeley.edu/~cs161/fa17/assets/lectures/18-netsec2.pdf (Page 21)