RFC 6467
Secure Password Framework for Internet Key Exchange Version 2 (IKEv2)
Secure Password Framework for Internet Key Exchange Version 2 (IKEv2) 🎀 (Part 1 of 3)
Title block tea ☕: this doc is RFC 6467, written by T. Kivinen from AuthenTec 💅. It's Category: Informational (so NOT a standards-track thing, just vibes and info 🧚), dated December 2011, with ISSN 2070-1721. The header doesn't list anything it obsoletes or updates, so it's a standalone moment 🌸.
Abstract
okay so this doc gives IKEv2 (the handshake that sets up IPsec tunnels 🔐) a generic way to use any of the symmetric secure password authentication methods ✨. Here's the tea: those methods already exist in other documents, and this one doesn't add a new one 🙈. What it does do is say how two peers agree on which method to use for the current connection, plus give them one common way to send each other the payloads that are specific to those password methods 💜.
Status of This Memo
bestie, this part is the legal-ish bit 🧾 but it's still cute. This document is not an Internet Standards Track specification. It's published for informational purposes 🦋.
It IS a product of the IETF, and it represents the consensus of the IETF community 🫶. It got public review and was approved for publication by the IESG (Internet Engineering Steering Group). BUT not every IESG-approved doc is up for any level of Internet Standard, so see Section 2 of RFC 5741 for that drama 💀.
For the current status, any errata, and how to send feedback, check http://www.rfc-editor.org/info/rfc6467 🌈.
Copyright Notice
Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved ©️💖.
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. Please actually read these, because they're your rights and restrictions 📜. Code Components pulled out of this doc must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Simplified BSD License describes 🔥.
Table of Contents
1. Introduction ....................................................2
2. Method Negotiation ..............................................4
3. Generic Secure Password Method Payload ..........................6
4. IKE_AUTH Exchange ...............................................7
5. Security Considerations .........................................9
6. IANA Considerations .............................................9
7. References .....................................................10
7.1. Normative References ......................................10
7.2. Informative References ....................................101. Introduction ✨
okay bestie, storytime 📖. The IPsecME working group was chartered to give IKEv2 ([RFC5996]) a symmetric secure password authentication protocol 🔑. It has to work with low-entropy shared secrets (aka passwords people can actually remember 🙈), protect against off-line dictionary attacks, and do all of that without needing certificates or the Extensible Authentication Protocol (EAP) 🛡️.
Now the messy part 😭. There are multiple candidates, and the working group was supposed to pick one. Unfortunately, they didn't pick one protocol, so there are multiple candidates going forward as separate documents 💀. Each of those older versions used a different technique to negotiate the method and different payload formats, which makes it super hard to build one implementation where all of these systems can co-exist 🥲.
Current document versions ([SPSK-AUTH], [PACE], and [PAKE]) use the method described in this document 💅.
This document describes the IKEv2 payload formats that multiple secure password methods can use to negotiate and transmit their data, so each method can easily co-exist in the same implementation 🧚✨.
This document has two major parts 💖:
- How to negotiate which secure password method negotiation is used.
- How to transmit data, between peers, that is specific to secure password methods.
Secure password methods usually aren't meant for the normal end user (remote access VPN) cases 🙅♀️. In those cases, EAP-based authentication works fine, and the asymmetric nature of EAP doesn't matter 🌸. Those scenarios are usually backed up by back-end Authentication, Authorization, and Accounting (AAA) servers and other infrastructure 🏢. So in that setup, neither IKEv2 peer really knows the secret: one end has the user type it in when needed, and the other end is authenticated by the back-end AAA server 🤷♀️.
The new secure password methods are meant for things like authentication between two servers or routers 🖥️💜. These scenarios are usually symmetric: both peers know the shared secret, no back-end authentication servers are involved, and either end can start an IKEv2 connection 🦋. Note that EAP could also support this model, but only when an EAP method that can run symmetrically is in use, the EAP method is directly implemented on both peers, and no AAA is in use 🫶.
In many cases, each implementation will use only one of the proposed secure password authentication methods. Even so, it can include support for multiple methods, even when only one of them will actually be used 🎀. For example, a general-purpose operating system running IPsec and IKEv2, and supporting secure password authentication methods to protect the services it provides, might need to implement several methods 👑. It's then up to the administrator which one gets used 🧑💻. Since the server might need to connect to multiple other servers, each implementing a different set of methods, it may not be possible to pick one method that serves every case 😩.
The secure password methods mostly keep the existing IKEv2 IKE_SA_INIT exchange and modify the IKE_AUTH authentication step ✨. Those methods don't want to add new round trips, so negotiating which secure password method to use has to happen during IKE_SA_INIT ⚡. The identity of the other end is only provided inside IKE_AUTH, so the responder has to select its list of supported methods based only on the IP address of the initiator 🧐. This could cause problems if only certain methods would be acceptable for certain identified peers 💀. Thankfully, since authentication is based on the secret shared between both peers, that shared secret should be usable in all of the methods 🔐. So a remote peer usually doesn't need to restrict method selection based on the initiator's identity, only on the supported methods and the administrative policy 🙌.
Also, since the initiator already knows which peer it's connecting with, it can limit which methods it proposes to that peer 🎯. And because secure password methods are meant for symmetric cases, both ends should have similar configuration: same shared secret and, most likely, a list of acceptable authentication methods too 👯. You could read this as meaning there's no need to support method negotiation at all, since both ends can already see this from their configuration 🤔. On the other hand, in most cases either end doesn't really care which method gets used, as long as it's willing to use any secure method the other end supports 🌈. In those cases, automatic negotiation makes the configuration easy, because nobody has to pick one method to be used between the peers ✨.
Now the big reason for using the common IKEv2 payload to transmit method-specific data between peers 🧠: the payload type field in IKEv2 is only an 8-bit field, and 62.5% of its range is already reserved (50% for private use numbers, and 12.5% for IKEv1 payload numbers) 😱. That leaves 95 usable numbers, and 16 of those are already in use 📉. At first, it was proposed that five payload type numbers be consumed 💀. Those five new payload types would already be a 31% increase in the number of currently allocated payload types 🚨.
Part 1 of 3. More coming up, bestie 💖🧚
2. Method Negotiation ✨
okay so bestie, all of the methods modify the IKE_AUTH exchange, which means the choice of secure password method has to be negotiated during the IKE_SA_INIT exchange 🔥 the negotiation exchange looks like this:
Initiator Responder
-------------------------------------------------------------------
HDR(SPIi=xxx, SPIr=0, IKE_SA_INIT,
Flags: Initiator, Message ID=0),
SAi1, KEi, Ni, [N(SECURE_PASSWORD_METHODS)] -->
<-- HDR(SPIi=xxx, SPIr=yyy, IKE_SA_INIT,
Flags: Response, Message ID=0),
SAr1, KEr, Nr, [CERTREQ],
[N(SECURE_PASSWORD_METHODS)]if the N(SECURE_PASSWORD_METHODS) Notify payload is missing, then normal IKEv2 authentication methods are used 🌸 if the Notify payloads are included, then the negotiation of the secure password methods happens inside those payloads 💅
future secure password methods might change the IKE_AUTH payload in a more substantial way, so it's better that the negotiation ends with exactly one secure password method being used 👑 the initiator knows which methods work with that responder, so it sends a list of acceptable methods in its IKE_SA_INIT request. then the responder picks exactly one method and puts it in its response. main character energy, honestly 🦋
the secure password methods are identified by 16-bit IANA-allocated numbers stored in the Notify payload notification data field. if a method supports multiple password preprocessing methods, each of those can get its own number from this space, or the method can do its own negotiation of the preprocessing method later 🧚 since the initiator has already picked the shared secret it'll use, it also knows which preprocessing it might need. so it should propose only those preprocessing methods that suit the selected shared secret. this is why it's recommended that separate IANA numbers be allocated for different preprocessing methods 💜
the actual Notify payload looks like this:
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Next Payload |C| RESERVED | Payload Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Protocol ID | SPI Size | Notify Message Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Security Parameter Index (SPI) ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Notification Data ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+the Protocol ID is zero, and the SPI Size is also zero, so the SPI field is empty 🍓 the Notify Message Type is 16424 ✨
the Notification Data holds the list of 16-bit secure password method numbers:
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Secure Password Method #1 | Secure Password Method #2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Secure Password Method #3 | ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+the response Notify payload contains exactly one 16-bit secure password method number inside the Notification Data field 🫶
3. Generic Secure Password Method Payload 🎀
this payload carries the data that's specific to the secure password method. IKE_AUTH exchanges might have a bunch of these inside, depending on what's required and specified by the secure password method 💖 the method was already selected during IKE_SA_INIT, so there's no need to repeat that info here. this payload only has the method-specific data. some secure password methods need multiple different payloads, and those are assumed to include their method-specific payload type inside the payload (for example, inside the first octet of the data). but that's up to the method, and a method is free to format its payload data however it wants 🦋
the Generic Secure Password Method (GSPM) payload looks like this:
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Next Payload |C| RESERVED | Payload Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Data Specific to the Secure Password Method ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+the Payload Type for this payload is 49, and the name used in this document is "GSPM payload." 🧚 if the method uses payload subtypes (which are specific to the secure password method) inside the GSPM payload, the format looks like this:
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Next Payload |C| RESERVED | Payload Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Subtype* | |
+-+-+-+-+-+-+-+-+ +
| |
~ Data Specific to the Secure Password Method ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* method-specific subtype fieldthis is just for illustration 🙈 the secure password method defines the exact format of the payload contents
4. IKE_AUTH Exchange 💅
since the negotiation happens during IKE_SA_INIT, the secure password methods can modify the IKE_AUTH exchange if needed. to make it easier to implement multiple methods, it is recommended that the IKE_AUTH exchange not be modified unnecessarily. adding zero, one, or multiple GSPM payloads to each exchange is needed, and so is the change to how the AUTH payload is calculated, but everything else should stay minimal 🌈
the IKE_AUTH exchange should look similar to when EAP is used. that means the first request includes IDi, SAi2, TSi, TSr, and some number of GSPM payloads. the response should include IDr and, again, a number of GSPM payloads. there may be multiple exchanges, each with some number of GSPM payloads. finally, once authentication is done, there's one last exchange where the request includes the AUTH payload (along with some number of GSPM payloads), and the response contains AUTH, SAr2, TSi, TSr, and some number of GSPM payloads. the number of GSPM payloads is up to the secure password method but usually will be less than 3. depending on the method, though, it might be more 🔥
the AUTH payload calculation should include all the data that would normally be included, plus the extra data the secure password method needs. the secure password method has to define how the AUTH payload is calculated 👑
since the AUTH payload calculation is changed, the secure password method should not use any of the existing authentication method numbers in the AUTH Payload Auth Method field. instead it should use the number allocated in this document. this number is meant to be used by all secure password authentication methods 🦋
Initiator Responder
-------------------------------------------------------------------
HDR(SPIi=xxx, SPIr=yyy, IKE_AUTH,
Flags: Initiator, Message ID=1),
SK {IDi, [CERTREQ,]
GSPM, [GSPM, ...,]
[IDr,] SAi2,
TSi, TSr} -->
<-- HDR(SPIi=xxx, SPIr=yyy, IKE_AUTH, Flags:
Response, Message ID=1),
SK {IDr, [CERT,]
GSPM, [GSPM, ...]}
HDR(SPIi=xxx, SPIr=yyy, IKE_AUTH,
Flags: Initiator, Message ID=2),
SK {GSPM, [GSPM, ...,]} -->
<-- HDR(SPIi=xxx, SPIr=yyy, IKE_AUTH, Flags:
Response, Message ID=2),
SK {GSPM, [GSPM, ...]}
...
HDR(SPIi=xxx, SPIr=yyy, IKE_AUTH,
Flags: Initiator, Message ID=x),
SK {[GSPM, ...,], AUTH} -->
<-- HDR(SPIi=xxx, SPIr=yyy, IKE_AUTH, Flags:
Response, Message ID=x),
SK {[GSPM, ...,] AUTH, SAr2,
TSi, TSr}the number of GSPM payloads and other payloads in each packet is defined only by the secure password method documentation. the representations in this document are just for illustration 🧚
5. Security Considerations 🔥
okay bestie, this one is serious 😭 this document doesn't describe an exact protocol, so the security considerations are not relevant here. any secure password method documentation that uses the payload types described here needs to also describe the security properties of the protocol it defines or discusses. so the method authors are the ones who have to explain the security, periodt 💀
6. IANA Considerations 🌸
this document allocates one new IKEv2 message type in the "Notify Messages Types - Status Types" registry:
16424 SECURE_PASSWORD_METHODSthis document also allocates one new number in the "IKEv2 Authentication Method" registry:
12 Generic Secure Password Authentication Methodthis document also adds one new payload type to the "IKEv2 Payload Types" registry:
49 Generic Secure Password Method GSPMthis document creates a new IANA registry, "IKEv2 Secure Password Methods":
0 Reservedvalues 1-1023 are unassigned. values 1024-65535 are for private use among mutually consenting parties. changes and additions to this registry are done by Expert Review 🌈
7. References 💜
7.1. Normative References
[RFC5996] Kaufman, C., Hoffman, P., Nir, Y., and P. Eronen,
"Internet Key Exchange Protocol Version 2 (IKEv2)",
RFC 5996, September 2010.7.2. Informative References
[PACE] Kuegler, D. and Y. Sheffer, "Password Authenticated
Connection Establishment with IKEv2", Work in Progress,
September 2011.
[PAKE] Shin, S. and K. Kobara, "Most Efficient Augmented
Password-Only Authentication and Key Exchange for
IKEv2", Work in Progress, July 2011.
[SPSK-AUTH] Harkins, D., "Secure PSK Authentication for IKE", Work
in Progress, July 2011.Author's Address 🦋
Okay so this is the little contact card at the very end of RFC 6467, and it's giving "here's where to find the author" ✨
Tero Kivinen 💖 AuthenTec 🎀 Eerikinkatu 28 🌸 HELSINKI FI-00180 🌈 Finland 🇫🇮
EMail: kivinen@iki.fi 💌
That's the whole RFC! Bestie, you made it through all three parts 😭🫶 Tero's email is right there if you ever want to reach out with a question about the spec. Iconic behaviour, no cap 💅👑
📦 where this page comes from
- ietf: rfc6467 2011-12
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms