JarryShaw · JarryShaw · Sep 15, 2026 · Sep 14, 2026 · Sep 14, 2026 · Sep 14, 2026
diff --git a/Pipfile b/Pipfile
@@ -15,6 +15,7 @@ pypcapkit = {editable = true,path = "."}
 pyshark = "*"
 dpkt = "*"
 scapy = "*"
+cryptography = "*"
 beautifulsoup4 = {extras = ["html5lib"],version = "*"}
 requests = {extras = ["socks"],version = "*"}
 autopep8 = "*"

diff --git a/docs/source/pcapkit/const/esp.rst b/docs/source/pcapkit/const/esp.rst
@@ -0,0 +1,59 @@
+==================================================================
+:class:`~pcapkit.protocols.internet.esp.ESP` Constant Enumerations
+==================================================================
+
+.. module:: pcapkit.const.esp
+
+This module contains all constant enumerations of
+:class:`~pcapkit.protocols.internet.esp.ESP` implementations. Available
+enumerations include:
+
+.. list-table::
+
+   * - :class:`ESP_Cipher <pcapkit.const.esp.cipher.Cipher>`
+     - Encryption Algorithm Transform IDs [*]_
+   * - :class:`ESP_Integrity <pcapkit.const.esp.integrity.Integrity>`
+     - Integrity Algorithm Transform IDs [*]_
+
+ESP has no algorithm registry of its own: an SA's algorithms are negotiated by
+IKEv2, so both enumerations are the corresponding IKEv2 *transform ID*
+sub-registries. They live here rather than under an ``ikev2`` package because
+:class:`~pcapkit.protocols.internet.esp.ESP` is the only thing in
+:mod:`pcapkit` that consumes them.
+
+Both enumerate every transform **IANA has registered**, which is a much larger
+set than :mod:`pcapkit` can apply. Which of them ESP actually implements is a
+separate question, answered by
+:data:`~pcapkit.protocols.internet.esp.CIPHER_SUITES` and
+:data:`~pcapkit.protocols.internet.esp.INTEGRITY_SUITES`.
+
+.. [*] https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml#ikev2-parameters-5
+.. [*] https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml#ikev2-parameters-7
+
+ESP Encryption Algorithm Transform IDs
+======================================
+
+.. module:: pcapkit.const.esp.cipher
+
+This module contains the constant enumeration for **Transform Type 1 -
+Encryption Algorithm Transform IDs**, which is automatically generated from
+:class:`pcapkit.vendor.esp.cipher.Cipher`.
+
+.. autoclass:: pcapkit.const.esp.cipher.Cipher
+   :members:
+   :undoc-members:
+   :show-inheritance:
+
+ESP Integrity Algorithm Transform IDs
+=====================================
+
+.. module:: pcapkit.const.esp.integrity
+
+This module contains the constant enumeration for **Transform Type 3 -
+Integrity Algorithm Transform IDs**, which is automatically generated from
+:class:`pcapkit.vendor.esp.integrity.Integrity`.
+
+.. autoclass:: pcapkit.const.esp.integrity.Integrity
+   :members:
+   :undoc-members:
+   :show-inheritance:
diff --git a/docs/source/pcapkit/const/index.rst b/docs/source/pcapkit/const/index.rst
@@ -39,6 +39,7 @@ Internet Layer
 .. toctree::
    :maxdepth: 2
 
+   esp
    hip
    ipv4
    ipv6

diff --git a/docs/source/pcapkit/corekit/context.rst b/docs/source/pcapkit/corekit/context.rst
@@ -0,0 +1,29 @@
+Parsing Context
+===============
+
+.. module:: pcapkit.corekit.context
+
+.. automodule:: pcapkit.corekit.context
+   :no-members:
+
+.. autoclass:: pcapkit.corekit.context.ProtocolContext
+   :no-members:
+   :show-inheritance:
+
+   .. automethod:: protocol
+   .. automethod:: __repr__
+
+.. autoclass:: pcapkit.corekit.context.ContextRegistry
+   :no-members:
+   :show-inheritance:
+
+   .. automethod:: register
+   .. automethod:: make
+   .. automethod:: match
+
+   .. automethod:: __getitem__
+   .. automethod:: __iter__
+   .. automethod:: __len__
+   .. automethod:: __contains__
+   .. automethod:: __bool__
+   .. automethod:: __repr__
diff --git a/docs/source/pcapkit/corekit/index.rst b/docs/source/pcapkit/corekit/index.rst
@@ -10,12 +10,15 @@ class :class:`~pcapkit.corekit.infoclass.Info`,
 protocol collection class :class:`~pcapkit.corekit.protochain.ProtoChain`,
 and :class:`~pcapkit.corekit.multidict.MultiDict` family inspired from
 :mod:`Werkzeug` for multientry :obj:`dict` data mapping, the
-:class:`~pcapkit.corekit.fields.field.Field` family for data parsing.
+:class:`~pcapkit.corekit.fields.field.Field` family for data parsing, and
+the :class:`~pcapkit.corekit.context.ContextRegistry` channel for caller
+supplied information that a protocol needs but the wire does not carry.
 
 .. toctree::
    :maxdepth: 2
 
    fields/index
+   context
    infoclass
    io
    module

diff --git a/docs/source/pcapkit/protocols/internet/esp.rst b/docs/source/pcapkit/protocols/internet/esp.rst
@@ -0,0 +1,123 @@
+ESP - Encapsulating Security Payload
+====================================
+
+.. module:: pcapkit.protocols.internet.esp
+
+.. automodule:: pcapkit.protocols.internet.esp
+   :no-members:
+
+.. autoclass:: pcapkit.protocols.internet.esp.ESP
+   :no-members:
+   :show-inheritance:
+
+   .. autoproperty:: name
+   .. autoproperty:: length
+
+   .. automethod:: id
+
+   .. automethod:: read
+   .. automethod:: make
+
+   .. automethod:: _make_data
+   .. automethod:: _payload_bytes
+   .. automethod:: _read_trailer
+   .. automethod:: _make_opaque
+
+   .. automethod:: __post_init__
+   .. automethod:: __index__
+
+Security Associations
+---------------------
+
+SA context is supplied through the generic, protocol keyed channel of
+:mod:`pcapkit.corekit.context`.
+
+.. autoclass:: pcapkit.protocols.internet.esp.SecurityAssociation
+   :no-members:
+   :show-inheritance:
+
+   .. autoproperty:: encryption_key
+   .. autoproperty:: salt
+   .. autoproperty:: integrity_key
+   .. autoproperty:: icv_length
+   .. autoproperty:: authenticated
+
+   .. automethod:: matches
+   .. automethod:: unavailable
+   .. automethod:: compute_icv
+   .. automethod:: decrypt
+   .. automethod:: encrypt
+
+   .. automethod:: _split_key
+   .. automethod:: __repr__
+
+.. autoclass:: pcapkit.protocols.internet.esp.ESPContext
+   :no-members:
+   :show-inheritance:
+
+   .. autoproperty:: associations
+
+   .. automethod:: protocol
+   .. automethod:: register
+   .. automethod:: match
+   .. automethod:: __repr__
+
+Algorithm Registries
+--------------------
+
+The algorithm enumerations are the IANA IKEv2 transform ID registries,
+generated into :mod:`pcapkit.const.esp` and re-exported here for convenience:
+:class:`Cipher <pcapkit.const.esp.cipher.Cipher>` is
+:class:`pcapkit.const.esp.cipher.Cipher` and :class:`Integrity
+<pcapkit.const.esp.integrity.Integrity>` is
+:class:`pcapkit.const.esp.integrity.Integrity`.
+
+Algorithm Support
+-----------------
+
+A registry enumerates what IANA assigned an ID to, which is far more than
+:mod:`pcapkit` implements. The tables below are the authority on what an SA may
+actually name, and the two ``get`` methods refuse anything outside them.
+
+.. autoclass:: pcapkit.protocols.internet.esp.CipherSuite
+   :members:
+   :undoc-members:
+   :show-inheritance:
+
+.. autoclass:: pcapkit.protocols.internet.esp.IntegritySuite
+   :members:
+   :undoc-members:
+   :show-inheritance:
+
+.. autodata:: pcapkit.protocols.internet.esp.CIPHER_SUITES
+
+.. autodata:: pcapkit.protocols.internet.esp.INTEGRITY_SUITES
+
+.. autofunction:: pcapkit.protocols.internet.esp._resolve
+
+Processing Status
+-----------------
+
+.. autoclass:: pcapkit.protocols.internet.esp.ESPStatus
+   :members:
+   :show-inheritance:
+
+.. autofunction:: pcapkit.protocols.internet.esp.load_cryptography
+
+Header Schemas
+--------------
+
+.. module:: pcapkit.protocols.schema.internet.esp
+
+.. autoclass:: pcapkit.protocols.schema.internet.esp.ESP
+   :members:
+   :show-inheritance:
+
+Data Models
+-----------
+
+.. module:: pcapkit.protocols.data.internet.esp
+
+.. autoclass:: pcapkit.protocols.data.internet.esp.ESP
+   :members:
+   :show-inheritance:
diff --git a/docs/source/pcapkit/protocols/internet/index.rst b/docs/source/pcapkit/protocols/internet/index.rst
@@ -21,13 +21,14 @@ internet layer, with detailed implementation and methods.
    hopopt
    ipsec
    ah
+   esp
    hip
    mh
    ipx
 
 .. todo::
 
-   Implements ECN, ESP, ICMP, ICMPv6, IGMP, Shim6.
+   Implements ECN, ICMP, ICMPv6, IGMP, Shim6.
 
 Protocol Registry
 -----------------

diff --git a/docs/source/pcapkit/protocols/internet/ipsec.rst b/docs/source/pcapkit/protocols/internet/ipsec.rst
@@ -8,7 +8,7 @@ IPsec - Internet Protocol Security
 only, which is a base class for Internet Protocol
 Security (IPsec) protocol family [*]_, eg.
 :class:`~pcapkit.protocols.internet.ah.AH` and
-:class:`~pcapkit.protocols.internet.esp.ESP` [*]_.
+:class:`~pcapkit.protocols.internet.esp.ESP`.
 
 .. autoclass:: pcapkit.protocols.internet.ipsec.IPsec
    :no-members:
@@ -22,4 +22,3 @@ Security (IPsec) protocol family [*]_, eg.
 .. rubric:: Footnotes
 
 .. [*] https://en.wikipedia.org/wiki/IPsec
-.. [*] :class:`~pcapkit.protocols.internet.esp.ESP` class is currently **NOT** implemented.
diff --git a/docs/source/pcapkit/vendor/esp.rst b/docs/source/pcapkit/vendor/esp.rst
@@ -0,0 +1,50 @@
+============================================================
+:class:`~pcapkit.protocols.internet.esp.ESP` Vendor Crawlers
+============================================================
+
+.. module:: pcapkit.vendor.esp
+
+This module contains all vendor crawlers of
+:class:`~pcapkit.protocols.internet.esp.ESP` implementations. Available
+vendor crawlers include:
+
+.. list-table::
+
+   * - :class:`ESP_Cipher <pcapkit.vendor.esp.cipher.Cipher>`
+     - Encryption Algorithm Transform IDs [*]_
+   * - :class:`ESP_Integrity <pcapkit.vendor.esp.integrity.Integrity>`
+     - Integrity Algorithm Transform IDs [*]_
+
+ESP has no algorithm registry of its own: an SA's algorithms are negotiated by
+IKEv2, so both crawlers pull the corresponding IKEv2 *transform ID*
+sub-registries, which are published as separate CSV files from the IKEv2
+parameters page.
+
+.. [*] https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml#ikev2-parameters-5
+.. [*] https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml#ikev2-parameters-7
+
+ESP Encryption Algorithm Transform IDs
+======================================
+
+.. module:: pcapkit.vendor.esp.cipher
+
+This module contains the vendor crawler for **Transform Type 1 - Encryption
+Algorithm Transform IDs**, which is automatically generating
+:class:`pcapkit.const.esp.cipher.Cipher`.
+
+.. autoclass:: pcapkit.vendor.esp.cipher.Cipher
+   :members: FLAG, LINK
+   :show-inheritance:
+
+ESP Integrity Algorithm Transform IDs
+=====================================
+
+.. module:: pcapkit.vendor.esp.integrity
+
+This module contains the vendor crawler for **Transform Type 3 - Integrity
+Algorithm Transform IDs**, which is automatically generating
+:class:`pcapkit.const.esp.integrity.Integrity`.
+
+.. autoclass:: pcapkit.vendor.esp.integrity.Integrity
+   :members: FLAG, LINK
+   :show-inheritance:
diff --git a/docs/source/pcapkit/vendor/index.rst b/docs/source/pcapkit/vendor/index.rst
@@ -49,6 +49,7 @@ Internet Layer
 .. toctree::
    :maxdepth: 2
 
+   esp
    hip
    ipv4
    ipv6

diff --git a/docs/source/pep.rst b/docs/source/pep.rst
@@ -42,15 +42,19 @@ but not yet done. Namely, grouped by each TCP/IP layer and ordered by protocol
 name alphabetically,
 
 * Link Layer: DSL, EAPOL, FDDI, ISDN, PPP
-* Internet Layer: ECN, ESP, ICMP, ICMPv6, IGMP, NDP, Shim6
+* Internet Layer: ECN, ICMP, ICMPv6, IGMP, NDP, Shim6
 * Transport Layer: DCCP, QUIC, RSVP
 * Application Layer: BGP, DHCP, DHCPv6, DNS, IMAP, LDAP, MQTT, NNTP, NTP,
   ONC/RPC, POP, RIP, RTP, SIP, SMTP, SNMP, SSH, Telnet, TLS/SSL, XMPP
 
-Specifically, I have attempted to implement **ESP** several years ago, and I
-abandoned the implementation in the `NotImplemented` folder due to some design
-flaws within PyPCAPKit at that time. But now, the protocol should be able to
-implement quite smoothly.
+**ESP** -- abandoned in the ``NotImplemented`` folder for years, because of
+design flaws within PyPCAPKit at the time -- is now implemented, c.f.
+:class:`~pcapkit.protocols.internet.esp.ESP`. It parses without keys, and
+decrypts when a Security Association is supplied through the protocol keyed
+:mod:`pcapkit.corekit.context` channel. What is still wanted there is wider
+algorithm coverage: ChaCha20-Poly1305 [:rfc:`7634`], AES-CCM [:rfc:`4309`] and
+AES-XCBC integrity [:rfc:`3566`] are not implemented, and neither are Extended
+Sequence Numbers.
 
 More over, :class:`~pcapkit.protocols.internet.mh.MH` requires some help to
 implement all the *message data* types, you can find more information in the

diff --git a/pcapkit/__init__.py b/pcapkit/__init__.py
@@ -110,7 +110,7 @@
 
     'ARP', 'Ethernet', 'L2TP', 'OSPF', 'RARP', 'VLAN',      # Link Layer
 
-    'AH', 'IP', 'IPsec', 'IPv4', 'IPv6', 'IPX',             # Internet Layer
+    'AH', 'ESP', 'IP', 'IPsec', 'IPv4', 'IPv6', 'IPX',      # Internet Layer
     'HIP', 'HOPOPT', 'IPv6_Frag', 'IPv6_Opts', 'IPv6_Route', 'MH',
                                                             # IPv6 Extension Header
 

diff --git a/pcapkit/const/__init__.py b/pcapkit/const/__init__.py
@@ -16,6 +16,7 @@
 
 # per protocol
 from pcapkit.const.arp import *
+from pcapkit.const.esp import *
 from pcapkit.const.ftp import *
 from pcapkit.const.hip import *
 from pcapkit.const.http import *
@@ -34,6 +35,8 @@
     'ETHERTYPE', 'LINKTYPE', 'TRANSTYPE', 'APPTYPE',
     # ARP
     'ARP_Hardware', 'ARP_Operation',
+    # ESP
+    'ESP_Cipher', 'ESP_Integrity',
     # FTP
     'FTP_Command', 'FTP_ReturnCode',
     # HIP
-Original file line number
+Diff line change
@@ Expand Up / @@ -39,6 +39,7 @@ Internet Layer @@
     .. toctree::
        :maxdepth: 2
+       esp
        hip
        ipv4
        ipv6
@@ Expand Down @@