IKE Header

Initiator’s IKE_SA SPI

Set by the UE

Responder’s IKE_SA SPI

0

First message jn IKE_SA_INIT exchange

Next Payload

‘00100001’B

SA

Exchange Type

‘00100010’B

IKE_SA_INIT

Security Association Payload

Next Payload

’00100010’B

KE

More proposal

‘00000010’B

Proposal #

‘00000001’B

First cryptographic suite (section 6.5 of TS 33.234)

Protocol ID

‘00000001’B

IKE

SPI size

‘00000000’B

Number of transforms

‘00000010’B

More transform

‘00000011’B

This is the transform for confidentiality

Transform type

‘00000001’B

Encryption

Transform ID

‘00000011’B

3DES in CBC mode (ENCR_3DES)

More transform

‘00000011’B

This is the transform for prf

Transform type

‘00000010’B

PRF

Transform ID

‘00000010’B

PRF_HMAC_SHA1 (HMAC‑SHA1)

More transform

‘00000011’B

This is the transform for integrity

Transform type

‘00000011’B

Integrity

Transform ID

‘00000010’B

HMAC-SHA1-96 (AUTH_HMAC_SHA1_96)

Last transform

‘00000000’B

This is the transform for DH

Transform type

‘00000100’B

DH

Transform ID

‘00000010’B

Diffie-Hellman group 2 (1024-bit MODP)

Last proposal

‘00000000’B

Proposal #

‘00000010’B

Second cryptographic suite (section 6.5 of TS 33.234)

Protocol ID

‘00000001’B

IKE

SPI size

‘00000000’B

Number of transforms

‘00000010’B

More transform

‘00000011’B

This is the transform for confidentiality

Transform type

‘00000001’B

Encryption

Transform ID

‘00001011’B

AES with 128-bit keys in CBC mode (ENCR_AES_CBC)

More transform

‘00000011’B

This is the transform for prf

Transform type

‘00000010’B

PRF

Transform ID

‘00000100’B

PRF_AES128_XCBC_AES-XCBC-PRF-128

More transform

‘00000011’B

This is the transform for integrity

Transform type

‘00000011’B

Integrity

Transform ID

‘00000101’B

AES-XCBC-MAC-96 (AUTH_AES-XCBC -96)

Last transform

‘00000000’B

This is the transform for DH

Transform type

‘00000100’B

DH

Transform ID

‘00000010’B

Diffie-Hellman group 2 (1024-bit MODP)

Key Exchange Payload

Next Payload

‘00101000’B

Nonce

DH Group #

‘0000000000000010’B

DH group 2

Key Exchange data

Set by the UE

Nonce Payload

Next Payload

‘00101001’B

Notify

UE IKE INIT HA

Nonce data

Random number set by the UE

REDIRECT_SUPPORTED Notify Payload

UE IKE INIT HA

Next Payload

‘00000000’B

No Next Payload

UE IKE INIT HA

Protocol ID

‘00000000’B

Notification is not specific to a particular security association

UE IKE INIT HA

SPI size

‘00000000’B

SPI field not present

UE IKE INIT HA

Notify Message Type

‘0100000000010110’B

REDIRECT_SUPPORTED

UE IKE INIT HA

REDIRECT_FROM Notify Payload

UE IKE INIT HA Redirected

Next Payload

‘00000000’B

No next payload

UE IKE INIT HA Redirected

Protocol ID

‘00000000’B

Notification is not specific to a particular security association

UE IKE INIT HA Redirected

SPI size

‘00000000’B

SPI field not present

UE IKE INIT HA Redirected

Notify Message Type

‘0100000000010110’B

REDIRECT_FROM

UE IKE INIT HA Redirected

GW Ident Type

Any allowed value (IPv6 or IPv4 or HA FQDN)

Set depending on how the UE has discovered the HA in the preamble

UE IKE INIT HA Redirected

New Responder GW Identity

Depends on GW Ident type

UE IKE INIT HA Redirected

UE IKE INIT HA

Part of IKE_INIT_SA request message sent to HA only

UE IKE INIT HA Redirected

Part of IKE_INIT_SA request message sent to HA only after a REDIRECT payload was received in a previous IKEV2 messages exchange

IKE Header

Initiator’s IKE_SA SPI

Same as that set by the UE in IKE_SA_INIT request

Responder’s IKE_SA SPI

Set by the SS

Next Payload

‘00100001’B

SA

Exchange Type

‘00100010’B

IKE_SA_INIT

Security Association Payload

Next Payload

’00100010’B

KE

Proposal

One of the 2 proposals included in IKE_SA_INIT at Step 1

Key Exchange Payload

Next payload

‘00 101000’B

Nonce

DH Group #

‘0000000000000010’B

DH group 2

Key Exchange data

Set by the SS

Nonce Payload

Next t payload

‘00000000’B

No Next Payload

Nonce data

Set by the SS

IKE Header

Initiator’s IKE_SA SPI

Same as that set by the UE in IKE_INIT_SA Request

Responder’s IKE_SA SPI

Same as that set by the SS in IKE_INIT_SA Response

Next Payload

‘00101110’B

E

Exchange Type

‘00100011’B

IKE_AUTH

Encrypted Payload

Next Payload

‘00100011’B

IDi

UE IKE AUTH1

Initialization Vector

Random value set by the UE

UE IKE AUTH1

Encrypted IKE Payloads

UE IKE AUTH1

Identification – Initiator Payload

UE IKE AUTH1

Next Payload

‘00101111’B

CP

UE IKE AUTH1

ID Type

00000010B

UE IKE AUTH1

ID

Set to MN-NAI

UE IKE AUTH1

Configuration Payload

UE IKE AUTH1

Next Payload

‘00100001’B

SA

UE IKE AUTH1

CFG Type

‘00000001’B

Request

UE IKE AUTH1

Configuration Attribute

‘00010000’B

MIP6_HOME_PREFIX attribute

UE IKE AUTH1 HA

Length

‘0000000000000000’B

UE IKE AUTH1 HA

Security Association Payload

UE IKE AUTH1

Next Payload

‘00101100’B

TSi

UE IKE AUTH1

Proposals

Any set of allowed values

UE IKE AUTH1

Traffic Selector – Initiator Payload

UE IKE AUTH1

Next Payload

‘00101100’B

TSr

UE IKE AUTH1

Traffic selector data

Any allowed set of values

UE IKE AUTH1

Traffic Selector – Responder Payload

UE IKE AUTH1

Next Payload

‘00100100’B

IDr

UE IKE AUTH1

Traffic selector data

Any allowed set of values

UE IKE AUTH1

Identification – Responder Payload

UE IKE AUTH1

Next Payload

‘00000000’B

No Next Payload

UE IKE AUTH1

ID Type

‘00000010’B

UE IKE AUTH1

ID

APN

UE IKE AUTH1

Next Payload

‘00110000’B

EAP

UE IKE AUTH2

Initialization Vector

Random value set by the UE

UE IKE AUTH2

Encrypted IKE Payloads

UE IKE AUTH2

Extensible Authentication Payload

UE IKE AUTH2

Next Payload

‘00000000’B

No Next Payload

UE IKE AUTH2

Code

‘00000010’B

Response

UE IKE AUTH2

Type

‘00010111’B

AKA

UE IKE AUTH2

Subtype

AKA-Challenge

UE IKE AUTH2

Attribute type

’00000011’B

AT_RES

UE IKE AUTH2

AT_RES

See TS 24.301 [28] subclause 9.9.3.4

UE IKE AUTH2

Next Payload

‘00100111’B

AUTH

UE IKE AUTH3

Initialization Vector

Random value set by the UE

UE IKE AUTH3

Encrypted IKE Payloads

UE IKE AUTH3

Authentication Payload

UE IKE AUTH3

Next Payload

‘00000000’B

No Next Payload

UE IKE AUTH3

Auth Method

’00000010’B

Shared Key Integrity code

UE IKE AUTH3

Auth Data

derived from the MSK obtained from AKA exchange

RFC 4306 defines the function to derive this key (section 2.15)

UE IKE AUTH3

Padding

Set by the UE

Fields from Encrypted payload

Pad Length

Set by the UE

Fields from Encrypted payload

Integrity checksum data

Set by the UE

Fields from Encrypted payload

UE IKE AUTH1

Part of IKE_AUTH request message sent to HA or ePDG after the reception of IKE_INIT_SA response

UE IKE AUTH1 HA

Part of IKE_AUTH request message sent to HA after the reception of IKE_INIT_SA response

UE IKE AUTH2

Part of IKE_AUTH request message sent to HA or ePDG after the reception of IKE_SA response message containing the certificate payload CERT

UE IKE AUTH3

Part of IKE_AUTH request message sent to HA or ePDG after the reception of IKE_SA response containing EAP and encryption payloads only

IKE Header

Initiator’s IKE_SA SPI

Same as that set by the UE in IKE_SA_INIT request

Responder’s IKE_SA SPI

Same as that set by the SS in IKE_SA_INIT response

Next Payload

‘00101110’B

E

Exchange Type

‘00100011’B

IKE_AUTH

Encrypted Payload

Next Payload

‘00100100’B

IDr

SS IKE AUTH1

Initialization Vector

Set by the SS

SS IKE AUTH1

Encrypted IKE Payloads

SS IKE AUTH1

Identification – Responder Payload

SS IKE AUTH1

Next Payload

‘00100101’B

CERT

SS IKE AUTH1

ID Type

‘00000010’B

SS IKE AUTH1

ID

APN

SS IKE AUTH1

Certificate Payload

SS IKE AUTH1

Next Payload

‘00110000’B

EAP

SS IKE AUTH1

Cert encoding

’00000100’B

X.509 certificate – signature

SS IKE AUTH1

Certificate data

Set by the SS

DER encoded X.509 certificate

SS IKE AUTH1

Extensible Authentication Payload

SS IKE AUTH1

Next Payload

‘00000000’B

No Next Payload

SS IKE AUTH1

Code

‘00000001’B

Request

SS IKE AUTH1

Type

‘00010111’B

AKA

SS IKE AUTH1

Subtype

AKA-Challenge

SS IKE AUTH1

Attribute type

’00000001’B

AT_RAND

SS IKE AUTH1

AT_RAND

An arbitrarily selected 128 bits value

SS IKE AUTH1

Attribute Type

‘00000010’B

AT_AUTN

SS IKE AUTH1

AT_AUTN

See TS 24.301 [28] subclause 9.9.3.2

SS IKE AUTH1

Next Payload

‘00110000’B

EAP

SS IKE AUTH2

Initialization Vector

Set by the SS

SS IKE AUTH2

Encrypted IKE Payloads

SS IKE AUTH2

Extensible Authentication Payload

SS IKE AUTH2

Next Payload

‘00000000’B

No Next Payload

SS IKE AUTH2

Code

‘00000011’B

Success

SS IKE AUTH2

Next Payload

‘00101111’B

CP

SS IKE AUTH3

Auth Method

’00000010’B

Shared Key Integrity code

SS IKE AUTH3

Auth Data

derived from the MSK obtained from AKA exchange

RFC 4306 defines the function to derive this key (section 2.15)

SS IKE AUTH3

Configuration Payload

SS IKE AUTH3

Next Payload

‘00100001’B

SA

SS IKE AUTH3

CFG Type

‘00000010’B

Reply

SS IKE AUTH3

Configuration Attribute

‘00010000’B

MIP6_HOME_PREFIX attribute

SS IKE AUTH3 HA

Length

‘0000000000010101’B

SS IKE AUTH3 HA

Prefix lifetime

Any allowed value

SS IKE AUTH3 HA

Home Prefix

IPv6 prefix – 16 bytes

SS IKE AUTH3 HA

Prefix length

‘10000000’B

Prefix length must be 64

SS IKE AUTH3 HA

Notify Payload

SS IKE AUTH3 HA redirect

Next Payload

‘00100001’B

SA

SS IKE AUTH3 HA redirect

Protocol ID

‘00000000’B

Notification is not specific to a particular security association

SS IKE AUTH3 HA redirect

SPI Size

‘00000000’B

SPI field not present

SS IKE AUTH3 HA redirect

Notify Message Type Length

‘0100000000010111’B

REDIRECT

SS IKE AUTH3 HA redirect

GW Ident Type

‘00000101’B

SS IKE AUTH3 HA redirect

New Responder GW Identity

IPv6 address of the HA to relocate

SS IKE AUTH3 HA redirect

GW Ident Type

‘00000001’B

SS IKE AUTH3 HA redirect

New Responder GW Identity

IPv4 address of the HA to relocate

Optional

SS IKE AUTH3 HA redirect

Security Association Payload

SS IKE AUTH3

Next Payload

‘00101101’

TSi

SS IKE AUTH3

Proposal

One of the 2 proposals included in IKE_AUTH Request at Step 3

SS IKE AUTH3

Traffic Selector – Initiator Payload

SS IKE AUTH3

Next Payload

‘00101100’B

TSr

SS IKE AUTH3

Traffic Selector data

Any allowed set of values

SS IKE AUTH3

Traffic Selector – Responder Payload

SS IKE AUTH3

Next Payload

‘00000000’B

No Next Payload

SS IKE AUTH3

Padding

Set by the SS

Fields from Encryption payload

Pad Length

Set by the SS

Fields from Encryption payload

Integrity checksum data

Set by the SS

Fields from Encryption payload

SS IKE AUTH1

Part of IKE_AUTH request message sent to the UE as part of the first IKE_AUTH Response message

SS IKE AUTH2

Part of IKE_AUTH request message sent to the UE as part of the second IKE_AUTH Response message

SS IKE AUTH3

Part of IKE_AUTH request message sent to the UE as part of the third IKE_AUTH Response message

SS IKE AUTH3 HA

Part of IKE_AUTH request message sent to the UE as part of the third IKE_AUTH Response message when the UE interacts with HA

SS IKE AUTH3 HA_redirect

Part of IKE_AUTH request message sent to the UE as part of the third IKE_AUTH Response message when the UE interacts with HA and the UE gets redirected

Type

‘10000110’B

Code

‘00000000’B

Checksum

Set by SS

ICMP checksum

Cur Hop Limit

‘00000000’B

Unspecified

M

Set by the SS

O

Set by the SS

Depends on access network specific settings

H

‘0’B

Prf

Set by the SS

Depends on access network specific settings

Prf

Set by the SS

Depends on access network specific settings

P

Set by the SS

Depends on access network specific settings

Reserved

‘00000’B

Router Lifetime

Set by the SS

Reachable Time

Set by the SS

Retrans Timer

Set by the SS

type

‘00000011’B

Prefix Information Option

Length

‘00000100’B

Prefix length

Set by the SS

L

‘1’B

A

Set by the SS

Valid Lifetime

Set by the SS

Preferred Lifetime

Set by the SS

Prefix

Set as per specific message content

IPv4 Source Address

UE IPv4 CoA (IPv4 address acquired by UE during network attachment)

UE IPv4

IPv4 Destination Address

IPv4 of Home Agent discovered during preamble

UE IPv4

UDP header

UE IPv4

Source Port

Set by UE

UE IPv4

Destination port

‘0001000001011111’B

UE IPv4

IPv6 Source Address

UE IPv6 CoA (IPv6 address acquired by the UE during network attachment)

IPv6 visited

IPv6 Home Address configured by the UE from Home Network Prefix assigned to UE during preamble

UE IPv6-home, UE IPv4

IPv6 Destination Address

IPv6 of Home Agent discovered during preamble

Destination Header

IPv6 Home Address configured by the UE from Home Network Prefix assigned to the UE during preamble

IPv6 visited

Payload Proto

‘00111011’B

MH Type

‘00000101’B

Binding Update message

Sequence Number

Any allowed value

Lifetime

Any allowed non-zero value

IPv6 visited

‘0000000000000000’B

UE IPv6-home

A

‘1’B

H

‘1’B

L

Not checked

K

‘1’B

M

’0’B

R

’1’B

P

‘0’B

F

’0’B

IPv4 Home Address option

Set to the value "0.0.0.0" to request allocation for the UE. The "P" flag is set to ‘0’B.

The Prefix Length is set to the requested prefix length of ’32’.

Optional

Alternate Care-of Address option

Same IPv6 address as that inserted in the IP Source Address field

UE IPv6-visited

UE IPv4

UE is in an IPv4 visited network (see RFC 5555)

UE IPv6-home

UE is in an IPv6 home network (see RFC 5555)

UE IPv6-visited

UE is in an IPv6 visited network (see RFC 5555)

IPv4 Source Address

IPv4 Home Agent address

UE IPv4

IPv4 Destination Address

Same value as UE IPv4 CoA in IP Source Address from Binding Update

UE IPv4

UDP header

UE IPv4

Source Port

‘0001000001011111’B

UE IPv4

Destination port

Same as Source port in Binding Update

UE IPv4

IPv6 Source Address

IPv6 Home Agent address

IPv6 Destination Address

Same value as UE IPv6 CoA in IP Source Address from Binding Update

UE IPv6-visited

IPv6 Home Address

UE IPv6-home, UE IPv4

Routing Header

Same value as UE IPv6 Home Address in Destination Header from Binding Update

UE IPv6-visited

Payload Proto

‘00111011’B

MH Type

‘00000110’B

Binding Acknowledgement message

Status

‘00000000’B

Binding Update accepted

K

Set by the SS

R

‘1’B

P

‘0’B

Sequence Number

Same value as that sent by the UE in the Binding Update

Lifetime

‘0000000010010110’B

10 min

UE IPv6-visited, UE IPv4

‘0000000000000000’B

UE IPv6-home

IPv4 Address Acknowledgement option

IPv4 Home Address allocated to the UE

Present if IPv4 Home Address option was included by the UE in Binding Update

Binding Refresh Advice option

‘0000000010010110’B

10 min

UE IPv4

UE is in an IPv4 visited network (see RFC 5555)

UE IPv6-home

UE is in an IPv6 home network (see RFC 5555)

UE IPv6-visited

UE is in an IPv6 visited network (see RFC 5555)

IPv4 Header

UE IPv4

IPv4 Source Address

UE IPv4 Home Agent address

UE IPv4

UDP header

UE IPv4

Source Port

Set by SS

UE IPv4

Destination port

‘0001000001011111’B

UE IPv4

IPv6 Header

IPv6 Source Address

IPv6 Home Agent address

IPv6 Destination Address

IPv6 Home Address configured by UE from Home Network Prefix assigned to UE during preamble

UE IPv4

IPv6 CoA

UE IPv6-visited

Routing Header

IPv6 Home Address configured by the UE from Home Network Prefix assigned to the UE during preamble

UE IPv6-visited

B.R. Type

‘00000001’B

B.R.I

Sequence Number

Set by the SS

Revocation Trigger

‘00000001’B

P

‘0’B

G

‘0’B

V

‘0’B

UE IPv4

UE is in an IPv4 visited network (see RFC 5555)

UE IPv6-visited

UE is in an IPv6 visited network (see RFC 5555)

IPv4 Header

UE IPv4

IPv4 Source Address

IPv4 CoA

UE IPv4

IPv4 Destination Address

UE IPv4 Home Agent Address

UE IPv4

UDP header

UDP header

UE IPv4

Source Port

‘0001000001011111’B

Source Port

UE IPv4

Destination port

Same as Source port in Binding Revocation

Destination port

UE IPv4

IPv6 Header

IPv6 Source Address

IPv6 Home Address configured by UE

UE IPv4

IPv6 CoA

UE IPv6-visited

IPv6 Destination Address

IPv6 of Home Agent address

IPv6 Destination Address

Destination Header

IPv6 Home Address configured by the UE

UE IPv6-visited

B.R. Type

‘00000010’B

B.R.A

Sequence Number

Same value as Sequence Number sent by the SS in Binding Revocation

Status

‘00000000’B

Success

P

‘0’B

G

‘0’B

V

‘0’B

UE IPv4

UE is in an IPv4 visited network (see RFC 5555)

UE IPv6-visited

UE is in an IPv6 visited network (see RFC 5555)