3.4.5.1 Receiving Message #1

  • Article

On receipt of message #1, a CGA authentication-supporting host MUST check for the presence of the "IKE CGA version 1" vendor ID payload. If an "IKE CGA version 1" vendor ID payload is present in message #1, the host MUST set the CGA_CAPABLE flag for the corresponding MMSAD entry.

The host MUST then look up its PAD to select one of the transforms that the peer proposes, as specified in [RFC2408] section 5.4.

If the host selects the proposed AUTH_CGA authentication method defined in section 3.4.1, the host MUST construct message #2, as specified in [RFC2409] section 5.1, and add an "IKE CGA version 1" vendor ID payload to advertise its CGA authentication capability.

The host MUST also use its CGA to communicate with the peer for this negotiation.