[IPsec] Can selected IPv6 Headers be part of Authenticated Data with ESP-GCM?

I have an interesting use case for a new IPv6 header that MAY be secure within the ESP payload, or MAY be exposed for inroute processing, but MUST be protected (authenticated data). My cursory review is not showing this is currently supported. Is it, our would I need to define a variant of

Re: [IPsec] Can selected IPv6 Headers be part of Authenticated Data with ESP-GCM?

Robert Moskowitz wrote: > I have an interesting use case for a new IPv6 header that MAY be secure > within the ESP payload, or MAY be exposed for inroute processing, but MUST be > protected (authenticated data). That's not the ESP model. ESP only protects something inside/after it.