IPFYI
RFC 7296 Internet Standard

Internet Key Exchange Protocol Version 2 (IKEv2)

C. Kaufman, P. Hoffman, Y. Nir, P. Eronen, T. Kivinen · 2014-10

Abstract

This document describes version 2 of the Internet Key Exchange (IKE) protocol. IKE is a component of IPsec used for performing mutual authentication and establishing and maintaining Security Associations (SAs). This document obsoletes RFC 5996.

Why This RFC Matters

RFC 7296 elevated IKEv2 to Internet Standard status, recognizing it as the definitive key exchange protocol for establishing IPsec Security Associations. IKEv2 dramatically simplified the IKEv1 state machine from 9 message exchanges down to 4 initial messages, added EAP support for flexible authentication, built in NAT traversal (NAT-T), and introduced MOBIKE (RFC 4555) for mobility. Every enterprise VPN gateway, mobile device VPN client, and site-to-site tunnel built after 2005 uses IKEv2 as the control plane for IPsec, making this RFC one of the most operationally significant security standards on the internet.

관련 프로토콜

IPSEC IKEV2 ESP AH UDP

관련 용어

ipsec vpn encryption authentication firewall

Security에서 더 보기

RFC 2404 The Use of HMAC-SHA-1-96 within ESP and AH RFC 3602 The AES-CBC Cipher Algorithm and Its Use with IPsec RFC 4253 The Secure Shell (SSH) Transport Layer Protocol RFC 4254 The Secure Shell (SSH) Connection Protocol RFC 4301 Security Architecture for the Internet Protocol RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 RFC 5280 Internet X.509 Public Key Infrastructure Certificate and CRL Profile RFC 6125 Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)