"Magic Numbers" for ISAKMP Protocol

Last Updated

• 2023-04-25

Note

All registries listed below have been closed. See RFC 9395.

Available Formats

• XML
• HTML
• TXT

IPSEC Situation Definition

Registration Procedure(s)

• Registry closed

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

The Situation Definition is a 32-bit bitmask which represents the environment under which the IPSEC SA proposal and negotiation is carried out. Requests for assignments of new situations must be accompanied by an RFC which describes the interpretation for the associated bit.

If the RFC is not on the standards-track (i.e., it is an informational or experimental RFC), it must be explicitly reviewed and approved by the IESG before the RFC is published and the transform identifier is assigned.

The upper two bits are reserved for private use amongst cooperating systems.

Available Formats

• CSV

IPSEC Security Protocol Identifiers

Registration Procedure(s)

• Registry closed

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

The Security Protocol Identifier is an 8-bit value which identifies a security protocol suite being negotiated. Requests for assignments of new security protocol identifiers must be accompanied by an RFC which describes the requested security protocol. [AH] and [ESP] are examples of security protocol documents.

If the RFC is not on the standards-track (i.e., it is an informational or experimental RFC), it must be explicitly reviewed and approved by the IESG before the RFC is published and the transform identifier is assigned.

Available Formats

• CSV

IPSEC ISAKMP Transform Identifiers

Registration Procedure(s)

• Registry closed

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

The IPSEC ISAKMP Transform Identifier is an 8-bit value which identifies a key exchange protocol to be used for the negotiation. Requests for assignments of new ISAKMP transform identifiers must be accompanied by an RFC which describes the requested key exchange protocol. [IKE] is an example of one such document.

If the RFC is not on the standards-track (i.e., it is an informational or experimental RFC), it must be explicitly reviewed and approved by the IESG before the RFC is published and the transform identifier is assigned.

Available Formats

• CSV

IPSEC AH Transform Identifiers

Registration Procedure(s)

• Registry closed

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

The IPSEC AH Transform Identifier is an 8-bit value which identifies a particular algorithm to be used to provide integrity protection for AH. Requests for assignments of new AH transform identifiers must be accompanied by an RFC which describes how to use the algorithm within the AH framework ([AH]).

If the RFC is not on the standards-track (i.e., it is an informational or experimental RFC), it must be explicitly reviewed and approved by the IESG before the RFC is published and the transform identifier is assigned.

Available Formats

• CSV

IPSEC ESP Transform Identifiers

Registration Procedure(s)

• Registry closed

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

The IPSEC ESP Transform Identifier is an 8-bit value which identifies a particular algorithm to be used to provide secrecy protection for ESP. Requests for assignments of new ESP transform identifiers must be accompanied by an RFC which describes how to use the algorithm within the ESP framework ([ESP]).

If the RFC is not on the standards-track (i.e., it is an informational or experimental RFC), it must be explicitly reviewed and approved by the IESG before the RFC is published and the transform identifier is assigned.

Available Formats

• CSV

IPSEC IPCOMP Transform Identifiers

Registration Procedure(s)

• Registry closed

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

The IPSEC IPCOMP Transform Identifier is an 8-bit value which identifier a particular algorithm to be used to provide IP-level compression before ESP. Requests for assignments of new IPCOMP transform identifiers must be accompanied by an RFC which describes how to use the algorithm within the IPCOMP framework ([IPCOMP]). In addition, the requested algorithm must be published and in the public domain.

If the RFC is not on the standards-track (i.e., it is an informational or experimental RFC), it must be explicitly reviewed and approved by the IESG before the RFC is published and the transform identifier is assigned.

Available Formats

• CSV

IPSEC Security Association Attributes

Registration Procedure(s)

• Registry closed

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

The IPSEC Security Association Attribute consists of a 16-bit type and its associated value. IPSEC SA attributes are used to pass miscellaneous values between ISAKMP peers. Requests for assignments of new IPSEC SA attributes must be accompanied by an Internet Draft which describes the attribute encoding (Basic/Variable-Length) and its legal values. Section 4.5 of this document provides an example of such a description.

Available Formats

• CSV

SA Life Type Values (Value 1)

Registration Procedure(s)

• Registry closed

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

Group Description (Value 3)

Note

Please refer to the registry Group Description (Value 4) at Internet Key Exchange (IKE) Attributes

Encapsulation Mode (Value 4)

Registration Procedure(s)

• Registry closed

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

Authentication Algorithm (Value 5)

Registration Procedure(s)

• Registry closed

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

Compression Private Algorithm (Value 9)

Registration Procedure(s)

• IANA does not assign

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP

Note

Specifies a private vendor compression algorithm. The first three (3) octets must be an IEEE assigned company_id (OUI). The next octet may be a vendor specific compression subtype, followed by zero or more octets of vendor data.

ECN Tunnel (Value 10)

Registration Procedure(s)

• Registry closed

Reference

• RFC 3168: The Addition of Explicit Congestion Notification (ECN) to IP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

If unspecified, the default shall be assumed to be Forbidden.

Available Formats

• CSV

Extended (64-bit) Sequence Number (Value 11)

Registration Procedure(s)

• No additional class values will be assigned for this attribute.

Reference

• RFC 4304: Extended Sequence Number (ESN) Addendum to IPsec Domain of Interpretation (DOI) for Internet Security Association and Key Management Protocol (ISAKMP)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

Signature Encoding Algorithm Values (Value 13)

Registration Procedure(s)

• Registry closed

Reference

• RFC 4359: The Use of RSA/SHA-1 Signatures within Encapsulating Security Payload (ESP) and Authentication Header (AH)
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

Address Preservation (Value 14)

Registration Procedure(s)

• Registry closed

Reference

• RFC 6407: The Group Domain of Interpretation
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

SA Direction (Value 15)

Registration Procedure(s)

• Registry closed

Reference

• RFC 6407: The Group Domain of Interpretation
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

IPSEC Labeled Domain Identifiers

Registration Procedure(s)

• Registry closed

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

The IPSEC Labeled Domain Identifier is a 32-bit value which identifies a namespace in which the Secrecy and Integrity levels and categories values are said to exist. Requests for assignments of new IPSEC Labeled Domain Identifiers should be granted on demand. No accompanying documentation is required, though Internet Drafts are encouraged when appropriate.

Available Formats

• CSV

IPSEC Identification Type

Registration Procedure(s)

• Registry closed

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

The IPSEC Identification Type is an 8-bit value which is used as a discriminant for interpretation of the variable-length Identification Payload. Requests for assignments of new IPSEC Identification Types must be accompanied by an RFC which describes how to use the identification type within IPSEC.

If the RFC is not on the standards track (i.e., it is an informational or experimental RFC), it must be explicitly reviewed and approved by the IESG before the RFC is published and the transform identifier is assigned.

Available Formats

• CSV

IPSEC Notify Message Types

Registration Procedure(s)

• Registry closed

Reference

• RFC 2407: The Internet IP Security Domain of Interpretation for ISAKMP
• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Note

The IPSEC Notify Message Type is a 16-bit value taken from the range of values reserved by ISAKMP for each DOI. There is one range for error messages (8192-16383) and a different range for status messages (24576-32767). Requests for assignments of new Notify Message Types must be accompanied by an Internet Draft which describes how to use the identification type within IPSEC.

Notify Messages - Error Types (8192-16383)

Registration Procedure(s)

• Registry closed

Reference

• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV

Notify Messages - Status Types (24576-32767)

Registration Procedure(s)

• Registry closed

Reference

• RFC 9395: Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms

Available Formats

• CSV