AH does only header authentication; ESP can perform authentication of the header and the data as well as encryption