TCP/IP Tutorial and Technical Overview - IBM Redbooks

IKE phase 2, message 1
Message 1 of a Quick Mode Exchange allows Host-A to authenticate itself, to
select a nonce, to propose Security Associations to Host-B, to execute an
exchange of public Diffie-Hellman values, and to indicate if it is acting on its own
behalf or as a proxy negotiator for another entity. An overview of the format of
message 1 is shown in Figure 22-41.
Note: Inclusion of a Key Exchange field is optional. However, when Perfect
Forward Secrecy is used, it must be present.
IP
Header
UDP
Header
ISAKMP
Header
Hash SA Proposal
#1
Transform
#1
Hash-1,SA(ESP & AH),gx, Nj
... Proposal
#n
Transform
#n
Host A Hash-2,SA(ESP & AH),gy, Nr
Host B
Hash-3
Figure 22-41 Message 1 of an ISAKMP phase 2 Quick Mode Exchange
N K
E
Because we assumed that Host-A and Host-B are each acting on their own
behalf, the user identity fields illustrated in Figure 22-41 will not be present. The
message will consist of:
ISAKMP header The ISAKMP header indicates an exchange type of
Quick Mode, includes a non-zero Message ID chosen
by Host-A, includes the initiator and responder cookie
values chosen in phase 1 (that is, Cookie-A and
Cookie-B), and turns on the encryption flag to indicate
that the payloads of the ISAKMP message are
encrypted according to the algorithm and key
negotiated during phase 1.
IDs
Chapter 22. TCP/IP security 841