3Com 3C13618 Command Reference Manual page 715

Description
Using the esp-new authentication-algorithm command, you can set the
authentication
authentication-algorithm command, you can use no encryption algorithm.
Default is md5-hmac-96, that is, MD5.
This command is applicable to the IPSec module of the operating system and crypto
card.
HMAC algorithm used encrypted HASH function to perform message authentication,
and implement integrity check based on secret key. HMAC technology provides a
frame for multiple hash functions, such as SHA-1 and MD5, thus providing data
source authentication and integrity protection, and preventing the data being
transmitted being modified.
sha1-hmac-96 algorithm performs on the basis of 64-byte data block, and produces
a 160-digit authentication secret key. The security protection is provided mainly by
HMAC and then SHA-1 algorithm.
md5-hmac-96 algorithm also performs on the basis of 64-byte data block, and
produces a 128-digit authentication secret key. The security protection is provided
mainly by HMAC and then MD5 algorithm.
By comparison, MD5 is faster than SHA-1, while SHA-1 is more secure than MD5.
ESP enables a packet to be encrypted and authenticated concurrently, or it enables
either of encryption and authentication. The encryption and authentication algorithms
used by ESP can not be set as vacant at the same time.
undo esp-new authentication-algorithm is not used to restore the authentication
algorithm to the default algorithm; instead it is used to set the authentication
algorithm to vacant, i.e. no authentication. When the encryption algorithm is vacant,
the undo esp-new authentication-algorithm command is invalidated.
The proposal set used by the IPSec policies set at both ends of the security tunnel
must be set as having the same authentication algorithm.
For related commands, see ipsec proposal, esp-new encryption-algorithm,
proposal, sa inbound/outbound, transform.
Example
# Configure a proposal set that adopts ESP, is not encrypted, and uses sha1.
[3Com]ipsec proposal trans1
[3Com-ipsec-proposal-trans1]transform esp-new
[3Com-ipsec-proposal-trans1]esp-new authentication-algorithm sha1-hmac-96
algorithm used by ESP. Using the
Security
undo esp-new
65