This document describes an extension to the TCP Authentication Option (TCP-AO) to encrypt the TCP segment payload in addition to providing TCP-AO's authentication of the payload, TCP header, and IP pseudoheader. This extension changes how the packet contents and headers are processed and which keys are derived, but not its key coordination or protection of long-lived connections.