When data including minimum padding are not divisible by these block sizes, padding must be added to reach the desired block size prior to algorithmic processing. When considering the implied 64-bit length field, the real limit is 448 bits. For randomly sized packets, padding as a percent of throughput increases as packet size decreases. Only in cases where all data are evenly divisible by the required block size is algorithmic overhead zero. Percentages calculated based on smallest packet size that is greater than size in column header and divisible by required block size.
HMAC processing adds overhead beyond that already incurred by padding requirements, as follows.
The HMAC effectively involves applying the SHA-1 or MD5 hash three times for any given packet, a result of two combined elements of the HMAC specification. Then a 64-bit representation of the overall message length is appended to the message. In addition to cryptographic algorithm overhead, IPsec incurs significant overhead caused by the addition of headers and message authentication bytes. The IPsec protocol requires that IPsec headers be added on top of the IP header. ESP provides both confidentiality and authentication.