RFC 7296
Internet Key Exchange Protocol Version 2 (IKEv2)
Standards Track Obsoletes: RFC 5996 October 2014
Abstract: IKEv2 establishes security associations for ESP and AH. It performs mutual authentication, negotiates cryptographic algorithms, and derives keying material. IKEv2 is the mandatory key management protocol for 3GPP NDS/IP (TS 33.210).
Canonical source: https://www.rfc-editor.org/rfc/rfc7296
| IETF Datatracker
1. Introduction
▶IKEv2 is the key management protocol for IPsec. It establishes, negotiates, modifies, and deletes Security Associations. IKEv2 replaces IKEv1 and ISAKMP, providing a cleaner, more efficient protocol.
3GPP mandates IKEv2 for all NDS/IP deployments (TS 33.210 §5.4). Authentication uses certificates (TS 33.310) or pre-shared keys depending on operator policy.
2. IKE_SA_INIT Exchange
▶The first exchange establishes the IKE SA with key material:
DoS Protection: The responder MAY send a COOKIE notification in IKE_SA_INIT response to force the initiator to prove reachability before allocating state — critical for SEG protection in operator networks.
Initiator Responder | | | IKE_SA_INIT request: | | HDR, SAi1, KEi, Ni | | [N(NAT_DETECTION_*)] | |--------------------------------->| | | | IKE_SA_INIT response: | | HDR, SAr1, KEr, Nr | | [CERTREQ] | | [N(NAT_DETECTION_*)] | |<---------------------------------| | | SAi1/SAr1 = Crypto proposals (ENCR, PRF, INTEG, DH) KEi/KEr = DH public values Ni/Nr = Nonces
3. IKE_AUTH Exchange
▶The second exchange authenticates the peers and establishes the first Child SA (ESP SA):
- Certificate auth (TS 33.310): RSA or ECDSA signatures over AUTH payload — preferred for NDS/IP
- EAP auth: Extensible authentication within IKE — used for remote access VPN to 3GPP core
- PSK auth: Pre-shared key HMAC — operator-managed, simpler but less scalable
Initiator Responder
| |
| IKE_AUTH request: |
| HDR, SK{IDi, [CERT], |
| [CERTREQ], [IDr], |
| AUTH, SAi2, TSi, TSr} |
|--------------------------------->|
| |
| IKE_AUTH response: |
| HDR, SK{IDr, [CERT], |
| AUTH, SAr2, TSi, TSr}|
|<---------------------------------|
| |
SK{} = Encrypted and authenticated
AUTH = Authentication payload (certificate or PSK)
TSi/TSr = Traffic Selectors (SPD entries) 4. CREATE_CHILD_SA Exchange
▶Used for rekeying existing SAs and creating additional Child SAs:
- Child SA creation: New ESP SA with fresh traffic selectors
- Child SA rekey: Replace expiring ESP SA with new keying material
- IKE SA rekey: Replace the IKE SA itself when lifetime expires
- Optional PFS: Additional DH exchange for perfect forward secrecy of Child SAs
5. 3GPP Algorithm Profile
▶| Transform | Algorithm | TS 33.210 Requirement |
|---|---|---|
| ENCR | AES-CBC-128/256 | MUST |
| ENCR | AES-GCM-128/256 | SHOULD (AEAD) |
| PRF | PRF-HMAC-SHA-256 | MUST |
| PRF | PRF-HMAC-SHA-384/512 | MAY |
| INTEG | HMAC-SHA-256-128 | MUST |
| DH | Group 14 (2048-bit MODP) | MUST |
| DH | Group 19 (256-bit ECP) | SHOULD |
| DH | Group 20 (384-bit ECP) | MAY |
6. NAT Traversal
▶IKEv2 includes built-in NAT traversal. When NAT is detected via NAT_DETECTION_SOURCE_IP/DESTINATION_IP notifications, ESP packets are encapsulated in UDP on port 4500.
- NAT detection uses hash of IP:port compared between peers
- UDP encapsulation adds 8 bytes overhead per ESP packet
- Keepalive packets maintain NAT bindings (default 20 second interval)
- Critical for NDS/IP when SEGs are behind NAT devices
7. Security Considerations
▶- IKEv2 DoS protection via COOKIE mechanism in IKE_SA_INIT
- Certificate-based authentication preferred over PSK for scalability
- SA lifetime should be configured to force periodic rekeying
- Window size for outstanding requests should be tuned for high-throughput SEG deployments