HP-UX IPSec Version A.03.02.02 Administrator's Guide HP-UX 11i version 2 and HP-UX 11i version 3 (762800-001, April 2014)

Table 17 AH and ESP Algorithms and Key Lengths
Key LengthAlgorithm
168 (3 x 56)ESP-3DES
128,192, and 256ESP-AES
128AH-MD5
160AH-SHA1
3DES (Triple-DES) uses three independent 56-bit keys. The data is encrypted three times, using the
three keys.
AES with HP-UX IPSec supports 128-bit, 192-bit, and 256-bit keys. AES encryption is stronger than
that of 3DES. In addition, processing speed is faster with AES.
HMAC-SHA1 generates a 160-bit message digest and uses a 160-bit shared secret key to encrypt
the digest.
HMAC-MD5 generates a 128-bit message digest and uses a 128-bit shared secret key to encrypt
the digest.
HMAC-SHA2 generates 256-bit, 384-bit, and 512-bit message digest.
Authentication Algorithms
The authentication algorithms described in this section provide authentication values for IPsec
Authentication Header (AH) and for authenticated ESP. The algorithms are based on shared key
hash functions.
AH-MD5
Hashed Message Authentication Code (HMAC) using the RSA Message Digest-5 algorithm. (128
bit message digest encrypted with a 128 bit key.)
AH-SHA1
HMAC using the Secure Hash Algorithm-l. (160 bit digest encrypted with 160 bit key.)
Encryption Algorithms
These algorithms are used to encrypt the IP payload for an IPsec Encapsulating Security Payload
(ESP). The ESP encryption algorithms provide confidentiality (encryption) and are used with an
authentication algorithm. ESP uses the authentication algorithm to compute an Integrity Check
Value (ICV) that authenticates the ESP header and IP data. The ICV does not authenticate the
original IP header unless tunnelling is used.
ESP-3DES-HMAC-MD5
ESP using triple DES-CBC encryption (3DES-CBC; three encryption iterations, each with a different
56-bit key) and HMAC-MD5 to generate an ICV.
ESP-3DES-HMAC-SHA1
ESP using 3DES-CBC encryption and HMAC-SHA1 to generate an ICV.
ESP-AES128-HMAC-MD5
ESP using Advanced Encryption Standard encryption with a 128-bit key (AES128) and HMAC-MD5
to generate an ICV.
ESP-AES128-HMAC-SHA1
Authenticated ESP using AES128 encryption and HMAC-SHA1 to generate an ICV.
ESP-NULL-HMAC-MD5
ESP header and trailer, but nothing is encrypted. ESP generates an ICV using HMAC-MD5.
144 Product Specifications