What protocol provides integrity in IPsec?

• A. AH
• B. ESP
• C. TLS
• D. SHA-1

Answer: (A)

The main idea here is that IPsec uses a protocol specifically to ensure that a packet hasn’t been tampered with and to verify who sent it. The Authentication Header is designed for this purpose: it provides data integrity and origin authentication for the entire IP packet. It computes a secure value (an HMAC) over the packet so the receiver can check that nothing was altered in transit and confirm the sender’s identity. It does not encrypt the payload, so confidentiality isn’t provided by this protocol.

In contrast, the other IPsec protocol is aimed at confidentiality, encrypting the payload to hide its contents, and it can offer integrity only as an optional feature. TLS operates at a different layer (not part of IPsec), and SHA-1 is a hash function itself, not a protocol.

So, for integrity within IPsec, the Authentication Header is the best fit because it is specifically responsible for verifying the integrity and authenticity of the IP packet.