icially in this book, as there are no mandatory host requirements for IPsec in the 3GPP. Generally in 3GPP hosts, as with any hosts, IPsec is only used for VPNs. Readers who are interested in IPsec should look at specific IPsec literature. While perhaps obvious, it is worth noting that while IPsec is optional, secure and solid design and implementation of any component of the IPv6 suite is a hard requirement in today's world. The IPsec architecture RFC 4301 [125] builds on the following key components: security protocols, security associations, key management, and cryptographic algorithms. These are briefly introduced in the following sections. Introduction to IPv6 3.8.1 Security Protocols The IPsec protocol suite offers services for authentication, integrity protection, anti-replay, access control, and encryption. All the other services except encryption can be achieved by use of AH [38]. With ESP [39] all the benefits of AH can be achieved, but encryption is also provided. This is one reason why RFC 6434 requires IPsec capable nodes implement ESP, while AH is optional [1]. Both AH and ESP can be used in two modes: transport and tunnel. In the transport mode the security is provided for the next layer protocols, such as for TCP and UDP, while in the tunnel mode the full IP packet is secured. The selection of the usage mode depends on the deployment scenario. For example, tunnel mode can be used to hide a tunneled packet's sender and recipient identities from eavesdroppers, who would only see the tunnel endpoint addresses. Tunnel mode can also be used to transport an IP address family that is not otherwise transportable; for example, IPv6 packets can be transported inside IPsec tunnels over IPv4 networks. One practical and typical use case for tunnel mode is an IPsec tunnel that securely tunnels and connects all IP-traffic between an enterprise's sites. The header structure of AH is illustrated in Figure 3.19 and ESP in Figure 3.20. An interesting property of the ESP header is that the payload field may actually 