| 6.3 |  | IPSec |
| 6.3.5 |  | Security associations |

| Security Associations (SAs) are one of the most basic concepts of IPSec. SAs represent a policy contract between two peers or hosts, and describe how the peers will use IPSec security services to protect network traffic. SAs contain all the security parameters needed to securely transport packets between the peers or hosts, and practically define the security policy used in IPSec.

Figure illustrates the concept of an SA. The routers in the picture use IPSec to protect traffic between hosts A and B. Therefore, each of the routers needs two SAs, which describe traffic protection in both directions. Establishment of SAs is a prerequisite for IPSec traffic protection to work. When relevant SAs are established, IPSec refers to them for all parameters needed to protect a particular traffic flow. For example, an SA might enforce the following policy: For traffic between hosts A and B use ESP 3DES with keys K1, K2 and K3 for payload encryption, SHA-1 with K4 for authentication.

SAs always contain unidirectional, or one-way, specifications. SAs are also encapsulation protocol specific. There is a separate SA for each encapsulation protocol, AH and ESP, for a given traffic flow. If two hosts A and B are communicating securely using both AH and ESP, then each host builds separate SAs, inbound and outbound, for each protocol. VPN devices store all their active SAs in a local database called the SA database (SADB).

An SA contains the following security parameters :

- Authentication/encryption algorithm, key length and other encryption parameters, such as key lifetime, used with protected packets
- Session keys for authentication, or HMACs, and encryption, which can be entered manually or negotiated automatically with the help of the IKE protocol, fed to the algorithms
- A specification of network traffic to which the SA will be applied, such as all IP traffic or only TELNET sessions
- IPSec AH or ESP encapsulation protocol and tunnel or transport mode

The Security Parameters Index (SPI) is a 32-bit number that identifies each established SA. The SPI uniquely identifies a particular SA in the SADB. Finally, SPIs are written into IPSec packet headers to locate the appropriate SA on the receiving system.