0                   1                   2                   30 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|               Security Parameters Index (SPI)                 |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|                      Sequence Number                          |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+---|                    IV (optional)                              | ^ p+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | a|                    Rest of Payload Data  (variable)           | | y~                                                               ~ | l|                                                               | | o+               +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | a|               |         TFC Padding * (optional, variable)    | v d+-+-+-+-+-+-+-+-+         +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+---|                         |        Padding (0-255 bytes)        |+-+-+-+-+-+-+-+-+-+-+-+-+-+     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|                               |  Pad Length   | Next Header   |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|         Integrity Check Value-ICV   (variable)                |~                                                               ~|                                                               |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+What    What    What# of     Requ'd  Encrypt Integ    isbytes      [1]   Covers  Covers  Xmtd------   ------  ------  ------  ------SPI                       4        M              Y     plainSeq# (low-order bits)     4        M              Y     plain       p------ aIV                     variable    O              Y     plain     | yIP datagram [2]        variable  M or D    Y      Y     cipher[3] |-lTFC padding [4]        variable    O       Y      Y     cipher[3] | o------ aPadding                 0-255      M       Y      Y     cipher[3]   dPad Length                1        M       Y      Y     cipher[3]Next Header               1        M       Y      Y     cipher[3]Seq# (high-order bits)    4     if ESN [5]        Y     not xmtdICV Padding            variable if need           Y     not xmtdICV                    variable   M [6]                 plain

   If ESN (see Appendix) is selected, only the low-order 32 bits of thesequence number are transmitted in the Sequence Number field,although both sender and receiver maintain full 64-bit ESN counters.The high order 32 bits are included in the integrity check in analgorithm/mode-specific fashion, e.g., the high-order 32 bits may beappended after the Next Header field when a separate integrityalgorithm is employed.

A3.1.  Triggering Re-synchronizationFor each SA, the receiver records the number of consecutive packetsthat fail authentication.  This count is used to trigger the re-synchronization process, which should be performed in the backgroundor using a separate processor.  Receipt of a valid packet on the SAresets the counter to zero.  The value used to trigger the re-synchronization process is a local parameter.  There is norequirement to support distinct trigger values for different SAs,although an implementer may choose to do so.A3.2.  Re-synchronization ProcessWhen the above trigger point is reached, a "bad" packet is selectedfor which authentication is retried using successively larger valuesfor the upper half of the sequence number (Seqh).  These values aregenerated by incrementing by one for each retry.  The number ofretries should be limited, in case this is a packet from the "past"or a bogus packet.  The limit value is a local parameter.  (Becausethe Seqh value is implicitly placed after the ESP (or AH) payload, itmay be possible to optimize this procedure by executing the integrityalgorithm over the packet up to the endpoint of the payload, thencompute different candidate ICVs by varying the value of Seqh.)Successful authentication of a packet via this procedure resets theconsecutive failure count and sets the value of T to that of thereceived packet.This solution requires support only on the part of the receiver,thereby allowing for backward compatibility.  Also, because re-synchronization efforts would either occur in the background orutilize an additional processor, this solution does not impacttraffic processing and a denial of service attack cannot divertresources away from traffic processing.