Internet Key Exchange (IKE) Attributes

Last Updated

• 2024-12-06

Note

All registries listed below have been closed. See RFC 9395.

Note

Attribute Assigned Numbers

Attributes negotiated during phase one use the following definitions. Phase two attributes are defined in the applicable DOI specification (for example, IPsec attributes are defined in the IPsec DOI), with the exception of a group description when Quick Mode includes an ephemeral Diffie-Hellman exchange. Attribute types can be either Basic (B) or Variable-length (V). Encoding of these attributes is defined in the base ISAKMP specification as Type/Value (Basic) and Type/Length/Value (Variable).

Attributes described as basic MUST NOT be encoded as variable. Variable length attributes MAY be encoded as basic attributes if their value can fit into two octets. If this is the case, an attribute offered as variable (or basic) by the initiator of this protocol MAY be returned to the initiator as a basic (or variable).

Available Formats

• XML
• HTML
• TXT

Attribute Classes

Registration Procedure(s)

• Registry closed

Reference

• RFC 2409: The Internet Key Exchange (IKE)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

Encryption Algorithm Class Values (Value 1)

Registration Procedure(s)

• Registry closed

Reference

• RFC 2409: The Internet Key Exchange (IKE)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

Hash Algorithm (Value 2)

Registration Procedure(s)

• Registry closed

Reference

• RFC 2409: The Internet Key Exchange (IKE)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

IPSEC Authentication Methods (Value 3)

Registration Procedure(s)

• Registry closed

Reference

• RFC 2409: The Internet Key Exchange (IKE)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

Group Description (Value 4)

Registration Procedure(s)

• Registry closed

Reference

• RFC 2409: The Internet Key Exchange (IKE)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

These values were reserved as per draft-ietf-ipsec-ike-ecc-groups which never made it to the RFC. These values might be used by some implementations as currently registered in the registry, but new implementations should not use them.

Available Formats

• CSV

Group Type (Value 5)

Registration Procedure(s)

• Registry closed

Reference

• RFC 2409: The Internet Key Exchange (IKE)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

Life Type (Value 11)

Registration Procedure(s)

• Registry closed

Reference

• RFC 2409: The Internet Key Exchange (IKE)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

For a given "Life Type" the value of the "Life Duration" attribute defines the actual length of the SA life -- either a number of seconds, or a number of kbytes protected.

Available Formats

• CSV

PRF (Value 13)

Registration Procedure(s)

• Registry closed

Reference

• RFC 2409: The Internet Key Exchange (IKE)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Exchange Type

Registration Procedure(s)

• Registry closed

Reference

• RFC 2408: Internet Security Association and Key Management Protocol (ISAKMP)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

DOI Specific use is the Additional Exchanges Defined registry

Available Formats

• CSV

Additional Exchanges Defined-- XCHG values

Registration Procedure(s)

• Registry closed

Reference

• RFC 2409: The Internet Key Exchange (IKE)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

ISAKMP Domain of Interpretation (DOI)

Registration Procedure(s)

• Registry closed

Reference

• RFC 2408: Internet Security Association and Key Management Protocol (ISAKMP)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

The Domain of Interpretation is a 32-bit value which identifies the context in which the Security Association payload is to be evaluated. Requests for assignments of new domain of interpretation identifiers must be accompanied by a public specification, such as an Internet RFC.

Available Formats

• CSV

Next Payload Types

Registration Procedure(s)

• Registry closed

Reference

• RFC 2408: Internet Security Association and Key Management Protocol (ISAKMP)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

The Next Payload type is an 8-bit value that indicates the type of the next payload in the message.

Available Formats

• CSV

Notify Message Types

Reference

• RFC 2408: Internet Security Association and Key Management Protocol (ISAKMP)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

Notify Messages - Error Types (1-8191)

Registration Procedure(s)

• Registry closed

Reference

• RFC 2408: Internet Security Association and Key Management Protocol (ISAKMP)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

Notify Messages - Status Types (16384-24575)

Registration Procedure(s)

• Registry closed

Reference

• RFC 2408: Internet Security Association and Key Management Protocol (ISAKMP)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV