Security Parameters Index: Difference between revisions

Revision as of 08:07, 28 February 2015

Latest revision as of 09:01, 8 July 2025

(10 intermediate revisions by 9 users not shown)

Line 1:

{{Multiple issues|

{{Unreferenced|date=February 2015}}

{{More citations needed|date=January 2017}}

{{Notability|date=February 2015}}

}}

The '''Security Parameter Index''' (SPI) is an identification tag added to the header while using [[IPsec]] for tunneling the IP traffic. This tag helps the kernel discern between two traffic streams where different encryption rules and algorithms may be in use.

The SPI (as per RFC 24014301) is ana essentialrequired part of an IPsec [[Security Association]] (SA) because it enables the receiving system to select the SA under which a received packet will be processed.{{Ref RFC|4301}} An SPI has only local significance, since it is defined by the creator of the SA; an SPI is generally viewed as an opaque bit string. However, the creator of an SA may interpret the bits in an SPI to facilitate local processing.

This works like port numbers in TCP and UDP connections. What it means is that there could be different SAs used to provide security to one connection. An SA could therefore act as a set of rules.

Carried in [[IPsec#Encapsulating_Security_PayloadEncapsulating Security Payload|Encapsulating Security Payload (ESP)]] header or [[IPsec#Authentication_HeaderAuthentication Header|Authentication Header (AH)]], its length is 32 bits.<ref>{{Cite journal|url=https://tools.ietf.org/html/rfc4303#section-2.1|title = IP Encapsulating Security Payload (ESP)|date = December 2005|last1 = Kent|first1 = Stephen| doi=10.17487/RFC4303 |url-access = subscription}}</ref>

==References==

{{Reflist}}

[[Category:IPsec]]

[[Category:Internet protocols]]

{{Compuinternet-stub}}