esp.h File Reference

ESP (RFC 4303) packet transform with AES-256-GCM (RFC 4106) - the IPsec datapath's crypto core. More...

#include "protocore_config.h"

Go to the source code of this file.

Detailed Description

ESP (RFC 4303) packet transform with AES-256-GCM (RFC 4106) - the IPsec datapath's crypto core.

Tier 3 of the IPsec roadmap item is the ESP datapath. Its two halves separate cleanly: this pure, host-testable PACKET transform (encapsulate a payload into an ESP packet / verify + decapsulate one), and the device-side network-layer integration (hooking lwIP's IP input/output + the SAD/SPD), which is a separate, later track. This file is only the transform, gated with the IKEv2 feature (its Child-SA keys - SK_ei / SK_er from pc_ike_child_keymat - drive it) and reusing the library's AES-256-GCM.

Wire layout (RFC 4303 §2, AES-GCM per RFC 4106): SPI(4) | Sequence Number(4) | IV(8, explicit) | { AES-GCM: Payload | Padding | Pad Length | Next Header } | ICV(16). The AEAD authenticates SPI | Seq as additional data; the nonce is the 4-byte salt (from the ESP key) concatenated with the 8-byte explicit IV. Padding right-aligns Pad Length + Next Header to a 4-octet boundary and holds the RFC 4303 monotonic bytes 1, 2, 3 ...

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file esp.h.