Internet Key Exchange (IKE) Attributes

Last Updated
2024-12-06
Note
All registries listed below have been closed. See [RFC 9395].
Note
Attribute Assigned Numbers

Attributes negotiated during phase one use the following definitions.
Phase two attributes are defined in the applicable DOI specification
(for example, IPsec attributes are defined in the IPsec DOI), with the
exception of a group description when Quick Mode includes an ephemeral
Diffie-Hellman exchange.  Attribute types can be either Basic (B) or
Variable-length (V). Encoding of these attributes is defined in the
base ISAKMP specification as Type/Value (Basic) and Type/Length/Value
(Variable).

Attributes described as basic MUST NOT be encoded as variable.
Variable length attributes MAY be encoded as basic attributes if their
value can fit into two octets. If this is the case, an attribute
offered as variable (or basic) by the initiator of this protocol MAY
be returned to the initiator as a basic (or variable).
Available Formats

XML
HTML
TXT

Registries Included Below

Attribute Classes

Registration Procedure(s)
Registry closed
Reference
[RFC 2409][RFC 9395]
Available Formats

CSV
Value Class Type Reference
1 Encryption Algorithm B [RFC 2409]
2 Hash Algorithm B [RFC 2409]
3 Authentication Method B [RFC 2409]
4 Group Description B [RFC 2409]
5 Group Type B [RFC 2409]
6 Group Prime/Irreducible Polynomial V [RFC 2409]
7 Group Generator One V [RFC 2409]
8 Group Generator Two V [RFC 2409]
9 Group Curve A V [RFC 2409]
10 Group Curve B V [RFC 2409]
11 Life Type B [RFC 2409]
12 Life Duration V [RFC 2409]
13 PRF B [RFC 2409]
14 Key Length B [RFC 2409]
15 Field Size B [RFC 2409]
16 Group Order V [RFC 2409]
17-16383 Unassigned
16384-32767 Reserved for private use

Encryption Algorithm Class Values (Value 1)

Registration Procedure(s)
Registry closed
Reference
[RFC 2409][RFC 9395]
Available Formats

CSV
Value Ecryption Algorithm Reference
0 Reserved
1 DES-CBC [RFC 2405]
2 IDEA-CBC [RFC 2409]
3 Blowfish-CBC [RFC 2409]
4 RC5-R16-B64-CBC [RFC 2409]
5 3DES-CBC [RFC 2409]
6 CAST-CBC [RFC 2409]
7 AES-CBC [RFC 3602]
8 CAMELLIA-CBC [RFC 4312]
9-65000 Unassigned
65001-65535 Reserved for private use

Hash Algorithm (Value 2)

Registration Procedure(s)
Registry closed
Reference
[RFC 2409][RFC 9395]
Available Formats

CSV
Value Hash Algorithm Reference
0 Reserved
1 MD5 [RFC 1321]
2 SHA [NIST, FIPS PUB 180-1: Secure Hash Standard, April 1995.]
3 Tiger [Anderson, R., and Biham, E., "Fast Software Encryption", Springer LNCS v. 1039, 1996.]
4 SHA2-256 [RFC 4868]
5 SHA2-384 [RFC 4868]
6 SHA2-512 [RFC 4868]
7-65000 Unassigned
65001-65535 Reserved for private use

IPSEC Authentication Methods (Value 3)

Registration Procedure(s)
Registry closed
Reference
[RFC 2409][RFC 9395]
Available Formats

CSV
Value Method Reference
0 Reserved
1 pre-shared key [RFC 2409]
2 DSS signatures [RFC 2409]
3 RSA signatures [RFC 2409]
4 Encryption with RSA [RFC 2409]
5 Revised encryption with RSA [RFC 2409]
6 Reserved (was Encryption with El-Gamal)
7 Reserved (was Revised encryption with El-Gamal)
8 Reserved (was ECDSA signatures)
9 ECDSA with SHA-256 on the P-256 curve [RFC 4754]
10 ECDSA with SHA-384 on the P-384 curve [RFC 4754]
11 ECDSA with SHA-512 on the P-521 curve [RFC 4754]
12-65000 Unassigned
65001-65535 Reserved for private use

Group Description (Value 4)

Registration Procedure(s)
Registry closed
Reference
[RFC 2409][RFC 9395]
Note
These values were reserved as per draft-ipsec-ike-ecc-groups
which never made it to the RFC. These values might be used by some
implementations as currently registered in the registry, but new
implementations should not use them.
Available Formats

CSV
Value Group Description Reference Note
0 Reserved
1 default 768-bit MODP group [RFC 2409] Section 6.1
2 alternate 1024-bit MODP group [RFC 2409] Section 6.2
3 EC2N group on GP[2^155] [RFC 2409] Section 6.3
4 EC2N group on GP[2^185] [RFC 2409] Section 6.4
5 1536-bit MODP group [RFC 3526] Section 2
6 EC2N group over GF[2^163](see Note) [draft-ietf-ipsec-ike-ecc-groups-10] Section 2.1
7 EC2N group over GF[2^163](see Note) [draft-ietf-ipsec-ike-ecc-groups-10] Section 2.2
8 EC2N group over GF[2^283](see Note) [draft-ietf-ipsec-ike-ecc-groups-10] Section 2.3
9 EC2N group over GF[2^283](see Note) [draft-ietf-ipsec-ike-ecc-groups-10] Section 2.4
10 EC2N group over GF[2^409](see Note) [draft-ietf-ipsec-ike-ecc-groups-10] Section 2.5
11 EC2N group over GF[2^409](see Note) [draft-ietf-ipsec-ike-ecc-groups-10] Section 2.6
12 EC2N group over GF[2^571](see Note) [draft-ietf-ipsec-ike-ecc-groups-10] Section 2.7
13 EC2N group over GF[2^571](see Note) [draft-ietf-ipsec-ike-ecc-groups-10] Section 2.8
14 2048-bit MODP group [RFC 3526] Section 3
15 3072-bit MODP group [RFC 3526] Section 4
16 4096-bit MODP group [RFC 3526] Section 5
17 6144-bit MODP group [RFC 3526] Section 6
18 8192-bit MODP group [RFC 3526] Section 7
19 256-bit random ECP group [RFC 5903]
20 384-bit random ECP group [RFC 5903]
21 521-bit random ECP group [RFC 5903]
22 1024-bit MODP Group with 160-bit Prime Order Subgroup [RFC 5114]
23 2048-bit MODP Group with 224-bit Prime Order Subgroup [RFC 5114]
24 2048-bit MODP Group with 256-bit Prime Order Subgroup [RFC 5114]
25 192-bit Random ECP Group [RFC 5114]
26 224-bit Random ECP Group [RFC 5114]
27 224-bit Brainpool ECP group [RFC 6932] Section 2.1. Not for RFC 2409.
28 256-bit Brainpool ECP group [RFC 6932] Section 2.2. Not for RFC 2409.
29 384-bit Brainpool ECP group [RFC 6932] Section 2.3. Not for RFC 2409.
30 512-bit Brainpool ECP group [RFC 6932] Section 2.4. Not for RFC 2409.
31-32767 Unassigned
32768-65535 Reserved for private use

Group Type (Value 5)

Registration Procedure(s)
Registry closed
Reference
[RFC 2409][RFC 9395]
Available Formats

CSV
Value Group Type Reference
0 Reserved
1 MODP (modular exponentiation group) [RFC 2409]
2 ECP (elliptic curve group over GF[P]) [RFC 2409]
3 EC2N (elliptic curve group over GF[2^N]) [RFC 2409]
4-65000 Unassigned
65001-65535 Reserved for private use

Life Type (Value 11)

Registration Procedure(s)
Registry closed
Reference
[RFC 2409][RFC 9395]
Note
For a given "Life Type" the value of the "Life Duration" attribute defines
the actual length of the SA life -- either a number of seconds, or a number
of kbytes protected.
Available Formats

CSV
Value Life Type Reference
0 Reserved
1 seconds [RFC 2409]
2 kilobytes [RFC 2409]
3-65000 Unassigned
65001-65535 Reserved for private use

PRF (Value 13)

Registration Procedure(s)
Registry closed
Reference
[RFC 2409][RFC 9395]
Value Description Reference
No registrations at this time.

Exchange Type

Registration Procedure(s)
Registry closed
Reference
[RFC 2408][RFC 9395]
Note
DOI Specific use is the Additional Exchanges Defined registry
Available Formats

CSV
Value Exchange Type Reference
0 NONE [RFC 2408]
1 Base [RFC 2408]
2 Identity Protection [RFC 2408]
3 Authentication Only [RFC 2408]
4 Aggressive [RFC 2408]
5 Informational [RFC 2408]
6-31 ISAKMP Future Use
32-239 DOI Specific Use
240-255 Private Use

Additional Exchanges Defined-- XCHG values

Registration Procedure(s)
Registry closed
Reference
[RFC 2409][RFC 9395]
Available Formats

CSV
Value Phase Reference
32 Quick Mode [RFC 2409]
33 New Group Mode [RFC 2409]

ISAKMP Domain of Interpretation (DOI)

Registration Procedure(s)
Registry closed
Reference
[RFC 2408][RFC 9395]
Note
The Domain of Interpretation is a 32-bit value which identifies the
context in which the Security Association payload is to be evaluated.
Requests for assignments of new domain of interpretation identifiers
must be accompanied by a public specification, such as an Internet RFC.
Available Formats

CSV
Value DOI Reference
0 ISAKMP [RFC 2408]
1 IPSEC [RFC 2407]
2 GDOI [RFC 3547]

Next Payload Types

Registration Procedure(s)
Registry closed
Reference
[RFC 2408][RFC 9395]
Note
The Next Payload type is an 8-bit value that indicates the type of the
next payload in the message.
Available Formats

CSV
Value Next Payload Type Reference
0 NONE [RFC 2408]
1 Security Association (SA) [RFC 2408]
2 Proposal (P) [RFC 2408]
3 Transform (T) [RFC 2408]
4 Key Exchange (KE) [RFC 2408]
5 Identification (ID) [RFC 2408]
6 Certificate (CERT) [RFC 2408]
7 Certificate Request (CR) [RFC 2408]
8 Hash (HASH) [RFC 2408]
9 Signature (SIG) [RFC 2408]
10 Nonce (NONCE) [RFC 2408]
11 Notification (N) [RFC 2408]
12 Delete (D) [RFC 2408]
13 Vendor ID (VID) [RFC 2408]
14 Reserved, not to be used [Dukes]
15 SA KEK Payload (SAK) [RFC 3547][RFC 6407]
16 SA TEK Payload (SAT) [RFC 3547][RFC 6407]
17 Key Download (KD) [RFC 3547]
18 Sequence Number (SEQ) [RFC 3547]
19 Proof of Possession (POP) [RFC 3547]
20 NAT Discovery (NAT-D) [RFC 3947]
21 NAT Original Address (NAT-OA) [RFC 3947]
22 Group Associated Policy (GAP) [RFC 6407]
23-127 Unassigned
128-255 Reserved for private use

Notify Message Types

Reference
[RFC 2408][RFC 9395]
Available Formats

CSV
Range Registration Procedures Note
1 - 8191 Registry closed Error types
8192 - 16383 Registry closed Doi-Specific Error types
16384 - 24575 Registry closed Status types RESERVED
24576 - 32767 Registry closed DOI-specific Status codes
32768 - 40959 Registry closed Private Use
40960 - 65535 Registry closed RESERVED

Notify Messages - Error Types (1-8191)

Registration Procedure(s)
Registry closed
Reference
[RFC 2408][RFC 9395]
Available Formats

CSV
Value Nofity Messages - Error Types Reference
1 INVALID-PAYLOAD-TYPE [RFC 2408]
2 DOI-NOT-SUPPORTED [RFC 2408]
3 SITUATION-NOT-SUPPORTED [RFC 2408]
4 INVALID-COOKIE [RFC 2408]
5 INVALID-MAJOR-VERSION [RFC 2408]
6 INVALID-MINOR-VERSION [RFC 2408]
7 INVALID-EXCHANGE-TYPE [RFC 2408]
8 INVALID-FLAGS [RFC 2408]
9 INVALID-MESSAGE-ID [RFC 2408]
10 INVALID-PROTOCOL-ID [RFC 2408]
11 INVALID-SPI [RFC 2408]
12 INVALID-TRANSFORM-ID [RFC 2408]
13 ATTRIBUTES-NOT-SUPPORTED [RFC 2408]
14 NO-PROPOSAL-CHOSEN [RFC 2408]
15 BAD-PROPOSAL-SYNTAX [RFC 2408]
16 PAYLOAD-MALFORMED [RFC 2408]
17 INVALID-KEY-INFORMATION [RFC 2408]
18 INVALID-ID-INFORMATION [RFC 2408]
19 INVALID-CERT-ENCODING [RFC 2408]
20 INVALID-CERTIFICATE [RFC 2408]
21 CERT-TYPE-UNSUPPORTED [RFC 2408]
22 INVALID-CERT-AUTHORITY [RFC 2408]
23 INVALID-HASH-INFORMATION [RFC 2408]
24 AUTHENTICATION-FAILED [RFC 2408]
25 INVALID-SIGNATURE [RFC 2408]
26 ADDRESS-NOTIFICATION [RFC 2408]
27 NOTIFY-SA-LIFETIME [RFC 2408]
28 CERTIFICATE-UNAVAILABLE [RFC 2408]
29 UNSUPPORTED-EXCHANGE-TYPE [RFC 2408]
30 UNEQUAL-PAYLOAD-LENGTHS [RFC 2408]
31-8191 RESERVED (Future Use)

Notify Messages - Status Types (16384-24575)

Registration Procedure(s)
Registry closed
Reference
[RFC 2408][RFC 9395]
Available Formats

CSV
Value Nofity Messages - Status Types Reference
16384 CONNECTED [RFC 2408]
16385-24575 RESERVED (Future Use)