2.2.1 ISAKMP Header Format Packet

  • Article

The Authenticated Internet Protocol messages are Internet Security Association and Key Management Protocol (ISAKMP) messages, as specified in [RFC2408] section 3, and [RFC3947] sections 3.2 and 5.2. Except where otherwise specified, each Authenticated Internet Protocol message consists of an ISAKMP header and a single Crypto payload that encapsulates a sequence of Authenticated Internet Protocol payloads. The payloads that are encapsulated by the Crypto payload are encrypted when the MM session keys are available. Prior to encryption, the Crypto payload is in clear text.

This protocol defines additional values for the Exchange_Type field of an ISAKMP message.

The ISAKMP message packet is used in the establishment, negotiation, modification, and deletion of security associations (SAs).

The following diagram shows the format of an ISAKMP message.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

ISAKMP_Header (28 bytes)

...

...

Payload (variable)

...

ISAKMP_Header (28 bytes): Contains the information that is required by the protocol to maintain state, process payloads, and possibly prevent denial-of-service or replay attacks. This is the standard ISAKMP header. For more details about the ISAKMP header, see [RFC2408].

The following diagram shows the subfields that are contained in the ISAKMP_Header.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

Initiator_Cookie

...

Responder_Cookie

...

Next_Payload

Major_Version

Minor_Version

Exchange_Type

Flags

Message_ID

Length

Initiator_Cookie (8 bytes): The cookie of entity that initiated security association (SA) establishment, SA notification, or SA deletion. This is identical to those cookies specified in [RFC2408] section 3.1.

Responder_Cookie (8 bytes): The cookie of entity that is responding to an SA establishment request, SA notification, or SA deletion. On the first message, the responder cookie is zero. This is identical to those cookies specified in [RFC2408] section 3.1. Each AuthIP negotiation is uniquely identified by the pair of initiator and responder cookies (plus UDP port and IP address).

Next_Payload (1 byte): Indicates the payload type of the first payload in the message. This is identical to the payload types specified in [RFC2408] section 3.1. The Authenticated Internet Protocol uses additional payloads in the PrivateUse range. The additional payloads are described in section 2.2.3.

ISAKMP payload type

Value

None

0x00

SecurityAssociation

0x01

Proposal

0x02

Transform

0x03

KeyExchange

0x04

Identification

0x05

Certificate

0x06

CertificateRequest

0x07

Hash

0x08

Signature

0x09

Nonce

0x0A

Notification

0x0B

Delete

0x0C

VendorID

0x0D

NAT Discovery Payload

0x14

NAT Original Address Payload

0x15

Reserved

0x0E — 0x7F

PrivateUse

0x80 — 0xFF

Major_Version (4 bits): Indicates the major version of the ISAKMP protocol in use. Implementations MUST set the major version to >= 1.

Minor_Version (4 bits): Indicates the minor version of the ISAKMP protocol in use. Implementations SHOULD set the minor version to 0. Packets that have a minor version number that is larger than 0 MUST be accepted.

Exchange_Type (1 byte): The Authenticated Internet Protocol exchange types are in the private use range, as specified in [RFC2408] section 3.1.

The Authenticated Internet Protocol main mode (MM) exchange corresponds to the IKEv1 identity protection exchange, as specified in [RFC2408] section 4.5.

The Authenticated Internet Protocol quick mode exchange corresponds to the IKEv1 quick mode exchange (as specified in [RFC2409] section 5.5).

The Authenticated Internet Protocol extended mode (EM) exchange corresponds to the identity protection exchange, as specified in section 3.7.

The Authenticated Internet Protocol notify exchange corresponds to the IKEv1 informational exchange, as specified in [RFC2408] section 4.8.

This protocol defines the exchange types that are shown in the following table.

Value

Meaning

0xF3

MM exchange type

0xF4

QM exchange type

0xF5

EM exchange type

0xF6

Notify exchange type

Flags (1 byte): Identical to those specified in [RFC2408] section 3.1. Only the E(encryption) flag is used. Use of the encryption flag is the same as [RFC2408]. The encryption flag MUST be set as specified in [RFC2408], section 3.1. The encryption flag MUST be set whenever an encrypted payload is sent. Encrypted payloads are denoted as HDR* in the diagrams in this specification. All other flags MUST be set to 0. In particular, there is no C(Commit) bit functionality as defined in [RFC2408], section 3.1.

Message_ID (4 bytes): The unique message identifier that is used to demultiplex messages from concurrent quick mode negotiations. This field MUST be set to 0 during main mode negotiations and MUST be set to 1 during Extended Mode negotiations. This value is generated by the initiator of the quick mode negotiation. This is identical to those specified in [RFC2408] section 3.1. This is set from the Current state field in the SA. See section 3.1.1 for details.

Length (4 bytes): The length, in bytes, of the total message (header + payloads). This is identical to those specified in [RFC2408] section 3.1.

Payload (variable): MUST contain a valid ISAKMP payload. The payload is used to transfer information such as SA data, or key generation and authentication data.