2005-01-18 2026-03-30 Expert Review Tero Kivinen, Valery Smyslov 0-33 Reserved 34 IKE_SA_INIT 35 IKE_AUTH 36 CREATE_CHILD_SA 37 INFORMATIONAL 38 IKE_SESSION_RESUME 39 GSA_AUTH 40 GSA_REGISTRATION 41 GSA_REKEY 42 GSA_INBAND_REKEY 43 IKE_INTERMEDIATE 44 IKE_FOLLOWUP_KE 45-239 Unassigned 240-255 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 No Next Payload 1-32 Reserved 33 Security Association
Security Association - GM Supported Transforms
SA
SAg

34 Key Exchange KE 35 Identification - Initiator IDi 36 Identification - Responder IDr 37 Certificate CERT 38 Certificate Request CERTREQ 39 Authentication AUTH 40 Nonce Ni, Nr 41 Notify N 42 Delete D 43 Vendor ID V 44 Traffic Selector - Initiator TSi 45 Traffic Selector - Responder TSr 46 Encrypted and Authenticated SK 47 Configuration CP 48 Extensible Authentication EAP 49 Generic Secure Password Method GSPM 50 Group Identification IDg 51 Group Security Association GSA 52 Key Download KD 53 Encrypted and Authenticated Fragment SKF 54 Puzzle Solution PS 55-127 Unassigned 128-255 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov "Key Exchange Method (KE)" transform type was originally named "Diffie-Hellman Group (D-H)" and was referenced by that name in a number of RFCs published prior to , which gave it the current title. All "Additional Key Exchange (ADDKE)" entries use the same "Transform Type 4 - Key Exchange Method Transform IDs" registry as the "Key Exchange Method (KE)" entry. The "Sequence Numbers (SN)" Transform Type was originally named "Extended Sequence Numbers (ESN)" and was referenced by that name in a number of RFCs published prior to , which gave it the current title. 0 Reserved 1 Encryption Algorithm (ENCR) (IKE, GIKE_UPDATE, ESP) 2 Pseudo-random Function (PRF) (IKE) 3 Integrity Algorithm (INTEG) (IKE, GIKE_UPDATE, AH, optional in ESP) 4 Key Exchange Method (KE) (IKE, optional in AH, ESP) 5 Sequence Numbers (SN) (AH, ESP) 6 Additional Key Exchange 1 (ADDKE1) (optional in IKE, AH, ESP) 7 Additional Key Exchange 2 (ADDKE2) (optional in IKE, AH, ESP) 8 Additional Key Exchange 3 (ADDKE3) (optional in IKE, AH, ESP) 9 Additional Key Exchange 4 (ADDKE4) (optional in IKE, AH, ESP) 10 Additional Key Exchange 5 (ADDKE5) (optional in IKE, AH, ESP) 11 Additional Key Exchange 6 (ADDKE6) (optional in IKE, AH, ESP) 12 Additional Key Exchange 7 (ADDKE7) (optional in IKE, AH, ESP) 13 Key Wrap Algorithm (KWA) (IKE, GIKE_UPDATE) 14 Group Controller Authentication Method (GCAUTH) (GIKE_UPDATE) 15-240 Unassigned 241-255 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0-13 Reserved 14 Key Length (in bits) TV 15-17 Reserved 18 Signature Algorithm Identifier TLV 19-16383 Unassigned 16384-32767 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov To find out requirement levels for encryption algorithms for ESP, see . For IKEv2, see . 0 Reserved - 1 ENCR_DES_IV64 DEPRECATED UNSPECIFIED - 2 ENCR_DES DEPRECATED 3 ENCR_3DES 4 ENCR_RC5 DEPRECATED 5 ENCR_IDEA DEPRECATED 6 ENCR_CAST DEPRECATED 7 ENCR_BLOWFISH DEPRECATED 8 ENCR_3IDEA DEPRECATED UNSPECIFIED 9 ENCR_DES_IV32 DEPRECATED UNSPECIFIED - 10 Reserved - 11 ENCR_NULL Not allowed 12 ENCR_AES_CBC 13 ENCR_AES_CTR 14 ENCR_AES_CCM_8 15 ENCR_AES_CCM_12 16 ENCR_AES_CCM_16 17 Unassigned 18 ENCR_AES_GCM_8 19 ENCR_AES_GCM_12 20 ENCR_AES_GCM_16 21 ENCR_NULL_AUTH_AES_GMAC Not allowed 22 Reserved for IEEE P1619 XTS-AES - 23 ENCR_CAMELLIA_CBC 24 ENCR_CAMELLIA_CTR - 25 ENCR_CAMELLIA_CCM_8 - 26 ENCR_CAMELLIA_CCM_12 - 27 ENCR_CAMELLIA_CCM_16 - 28 ENCR_CHACHA20_POLY1305 29 ENCR_AES_CCM_8_IIV Not allowed 30 ENCR_AES_GCM_16_IIV Not allowed 31 ENCR_CHACHA20_POLY1305_IIV Not allowed 32 ENCR_KUZNYECHIK_MGM_KTREE 33 ENCR_MAGMA_MGM_KTREE 34 ENCR_KUZNYECHIK_MGM_MAC_KTREE Not allowed 35 ENCR_MAGMA_MGM_MAC_KTREE Not allowed 36-1023 Unassigned 1024-65535 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov To find out requirement levels for PRFs for IKEv2, see . 0 Reserved 1 PRF_HMAC_MD5 DEPRECATED 2 PRF_HMAC_SHA1 3 PRF_HMAC_TIGER DEPRECATED UNSPECIFIED 4 PRF_AES128_XCBC 5 PRF_HMAC_SHA2_256 6 PRF_HMAC_SHA2_384 7 PRF_HMAC_SHA2_512 8 PRF_AES128_CMAC 9 PRF_HMAC_STREEBOG_512 10-1023 Unassigned 1024-65535 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov To find out requirement levels for encryption algorithms for ESP/AH, see . For IKEv2, see . 0 NONE 1 AUTH_HMAC_MD5_96 DEPRECATED 2 AUTH_HMAC_SHA1_96 3 AUTH_DES_MAC DEPRECATED UNSPECIFIED 4 AUTH_KPDK_MD5 DEPRECATED UNSPECIFIED 5 AUTH_AES_XCBC_96 6 AUTH_HMAC_MD5_128 DEPRECATED 7 AUTH_HMAC_SHA1_160 DEPRECATED 8 AUTH_AES_CMAC_96 9 AUTH_AES_128_GMAC 10 AUTH_AES_192_GMAC 11 AUTH_AES_256_GMAC 12 AUTH_HMAC_SHA2_256_128 13 AUTH_HMAC_SHA2_384_192 14 AUTH_HMAC_SHA2_512_256 15-1023 Unassigned 1024-65535 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov This registry was originally named "Transform Type 4 - Diffie-Hellman Group Transform IDs" and was referenced using that name in a number of RFCs published prior to , which gave it its current title. This registry is used by the "Key Exchange Method (KE)" transform type and by all "Additional Key Exchange (ADDKE)" transform types. To find out requirement levels for key exchange methods for IKEv2, see . The instructions for the designated experts are described in . While adding new Key Exchange (KE) methods, the following considerations must be applied. A key exchange method must take exactly one round trip (one IKEv2 exchange) and at the end of this exchange, both peers must be able to derive the shared secret. In addition, any public value that peersexchanged during a key exchange method must fit into asingle IKEv2 payload. If these restrictions are not metfor a key exchange method, then there must be documentationon how this key exchange method is used in IKEv2. 0 NONE 1 768-bit MODP Group DEPRECATED , Sec. 2.1 2 1024-bit MODP Group , Sec. 2.1 3-4 Reserved 5 1536-bit MODP Group , Sec. 2.1 6-13 Unassigned 14 2048-bit MODP Group , Sec. 2.1 15 3072-bit MODP Group , Sec. 2.1 16 4096-bit MODP Group , Sec. 2.1 17 6144-bit MODP Group , Sec. 2.1 18 8192-bit MODP Group , Sec. 2.1 19 256-bit random ECP group , Sec. 2.3 20 384-bit random ECP group , Sec. 2.3 21 521-bit random ECP group , Sec. 2.3 22 1024-bit MODP Group with 160-bit Prime Order Subgroup DEPRECATED , Sec. 2.2 23 2048-bit MODP Group with 224-bit Prime Order Subgroup , Sec. 2.2 24 2048-bit MODP Group with 256-bit Prime Order Subgroup , Sec. 2.2 25 192-bit Random ECP Group , Sec. 2.3 26 224-bit Random ECP Group , Sec. 2.3 27 brainpoolP224r1 , Sec. 2.3 28 brainpoolP256r1 , Sec. 2.3 29 brainpoolP384r1 , Sec. 2.3 30 brainpoolP512r1 , Sec. 2.3 31 Curve25519 , Sec. 3.2 32 Curve448 , Sec. 3.2 33 GOST3410_2012_256 RFC9385, Sec. 6.1 34 GOST3410_2012_512 RFC9385, Sec. 6.1 35 ml-kem-512 draft-kampanakis-ml-kem-ikev2-08, Sec. 2.3 36 ml-kem-768 draft-kampanakis-ml-kem-ikev2-08, Sec. 2.3 37 ml-kem-1024 draft-kampanakis-ml-kem-ikev2-08, Sec. 2.3 38-1023 Unassigned 1024-65535 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov This registry was originally named "Transform Type 5 - Extended Sequence Numbers Transform IDs" and was referenced using that name in a number of RFCs published prior to , which gave it the current title. The "32-bit Sequential Numbers" Transform ID was originally named "No Extended Sequence Numbers" and was referenced by that name in a number of RFCs published prior to , which gave it the current title. The "Partially Transmitted 64-bit Sequential Numbers" Transform ID was originally named "Extended Sequence Numbers" and was referenced by that name in a number of RFCs published prior to , which gave it the current title. Numbers in the range 2-65535 were originally marked as "Reserved" and were reclassified as "Unassigned" and "Reserved for Private Use" by . 0 32-bit Sequential Numbers 1 Partially Transmitted 64-bit Sequential Numbers 2 32-bit Unspecified Numbers 3-1023 Unassigned 1024-65535 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 Reserved 1 KW_5649_128 2 KW_5649_192 3 KW_5649_256 4 KW_ARX 5-1023 Unassigned 1024-65535 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 Reserved 1 Implicit 2 Digital Signature 3-1023 Unassigned 1024-65535 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 Reserved 1 ID_IPV4_ADDR 2 ID_FQDN 3 ID_RFC822_ADDR 4 Unassigned 5 ID_IPV6_ADDR 6-8 Unassigned 9 ID_DER_ASN1_DN 10 ID_DER_ASN1_GN 11 ID_KEY_ID 12 ID_FC_NAME 13 ID_NULL 14-200 Unassigned 201-255 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 Reserved 1 PKCS #7 wrapped X.509 certificate UNSPECIFIED 2 PGP Certificate UNSPECIFIED 3 DNS Signed Key UNSPECIFIED 4 X.509 Certificate - Signature 5 Reserved 6 Kerberos Token UNSPECIFIED 7 Certificate Revocation List (CRL) 8 Authority Revocation List (ARL) UNSPECIFIED 9 SPKI Certificate UNSPECIFIED 10 X.509 Certificate - Attribute UNSPECIFIED 11 Raw RSA Key (DEPRECATED) 12 Hash and URL of X.509 certificate 13 Hash and URL of X.509 bundle 14 OCSP Content 15 Raw Public Key 16-200 Unassigned 201-255 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov To find out requirement levels for IKEv2 authentication methods, see . 0 Reserved 1 RSA Digital Signature 2 Shared Key Message Integrity Code 3 DSS Digital Signature 4-8 Unassigned 9 ECDSA with SHA-256 on the P-256 curve 10 ECDSA with SHA-384 on the P-384 curve 11 ECDSA with SHA-512 on the P-521 curve 12 Generic Secure Password Authentication Method 13 NULL Authentication 14 Digital Signature 15-200 Unassigned 201-255 Reserved for Private Use Tero Kivinen, Valery Smyslov 0-8191 Expert Review 8192-16383 Private Use 0 Reserved 1 UNSUPPORTED_CRITICAL_PAYLOAD 2-3 Reserved 4 INVALID_IKE_SPI 5 INVALID_MAJOR_VERSION 6 Reserved 7 INVALID_SYNTAX 8 Reserved 9 INVALID_MESSAGE_ID 10 Reserved 11 INVALID_SPI 12-13 Reserved 14 NO_PROPOSAL_CHOSEN 15-16 Reserved 17 INVALID_KE_PAYLOAD 18-23 Reserved 24 AUTHENTICATION_FAILED 25-33 RESERVED 34 SINGLE_PAIR_REQUIRED 35 NO_ADDITIONAL_SAS 36 INTERNAL_ADDRESS_FAILURE 37 FAILED_CP_REQUIRED 38 TS_UNACCEPTABLE 39 INVALID_SELECTORS 40 UNACCEPTABLE_ADDRESSES 41 UNEXPECTED_NAT_DETECTED 42 USE_ASSIGNED_HoA 43 TEMPORARY_FAILURE 44 CHILD_SA_NOT_FOUND 45 INVALID_GROUP_ID 46 AUTHORIZATION_FAILED 47 STATE_NOT_FOUND 48 TS_MAX_QUEUE 49 REGISTRATION_FAILED 50-8191 Unassigned 8192-16383 Reserved for Private Use Tero Kivinen, Valery Smyslov 16384-40959 Expert Review 40960-65535 Private Use 16384 INITIAL_CONTACT 16385 SET_WINDOW_SIZE 16386 ADDITIONAL_TS_POSSIBLE 16387 IPCOMP_SUPPORTED 16388 NAT_DETECTION_SOURCE_IP 16389 NAT_DETECTION_DESTINATION_IP 16390 COOKIE 16391 USE_TRANSPORT_MODE 16392 HTTP_CERT_LOOKUP_SUPPORTED 16393 REKEY_SA 16394 ESP_TFC_PADDING_NOT_SUPPORTED 16395 NON_FIRST_FRAGMENTS_ALSO 16396 MOBIKE_SUPPORTED 16397 ADDITIONAL_IP4_ADDRESS 16398 ADDITIONAL_IP6_ADDRESS 16399 NO_ADDITIONAL_ADDRESSES 16400 UPDATE_SA_ADDRESSES 16401 COOKIE2 16402 NO_NATS_ALLOWED 16403 AUTH_LIFETIME 16404 MULTIPLE_AUTH_SUPPORTED 16405 ANOTHER_AUTH_FOLLOWS 16406 REDIRECT_SUPPORTED 16407 REDIRECT 16408 REDIRECTED_FROM 16409 TICKET_LT_OPAQUE 16410 TICKET_REQUEST 16411 TICKET_ACK 16412 TICKET_NACK 16413 TICKET_OPAQUE 16414 LINK_ID 16415 USE_WESP_MODE 16416 ROHC_SUPPORTED 16417 EAP_ONLY_AUTHENTICATION 16418 CHILDLESS_IKEV2_SUPPORTED 16419 QUICK_CRASH_DETECTION 16420 IKEV2_MESSAGE_ID_SYNC_SUPPORTED 16421 IPSEC_REPLAY_COUNTER_SYNC_SUPPORTED 16422 IKEV2_MESSAGE_ID_SYNC 16423 IPSEC_REPLAY_COUNTER_SYNC 16424 SECURE_PASSWORD_METHODS 16425 PSK_PERSIST 16426 PSK_CONFIRM 16427 ERX_SUPPORTED 16428 IFOM_CAPABILITY 3GPP TS 24.303 v10.6.0 annex B.2 16429 GROUP_SENDER 16430 IKEV2_FRAGMENTATION_SUPPORTED 16431 SIGNATURE_HASH_ALGORITHMS 16432 CLONE_IKE_SA_SUPPORTED 16433 CLONE_IKE_SA 16434 PUZZLE 16435 USE_PPK 16436 PPK_IDENTITY 16437 NO_PPK_AUTH 16438 INTERMEDIATE_EXCHANGE_SUPPORTED 16439 IP4_ALLOWED 16440 IP6_ALLOWED 16441 ADDITIONAL_KEY_EXCHANGE 16442 USE_AGGFRAG 16443 SUPPORTED_AUTH_METHODS 16444 SA_RESOURCE_INFO 16445 USE_PPK_INT 16446 PPK_IDENTITY_KEY 16447 IKE_SA_INIT_FULL_TRANSCRIPT_AUTH 16448-40959 Unassigned 40960-65535 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov To find out requirement levels for IPCOMP methods, see . 0 Reserved 1 IPCOMP_OUI UNSPECIFIED 2 IPCOMP_DEFLATE 3 IPCOMP_LZS 4 IPCOMP_LZJH 5-240 Unassigned 241-255 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 Reserved 1 IKE 2 AH 3 ESP 4 FC_ESP_HEADER 5 FC_CT_AUTHENTICATION 6 GIKE_UPDATE 7-200 Unassigned 201-255 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0-6 Reserved 7 TS_IPV4_ADDR_RANGE 8 TS_IPV6_ADDR_RANGE 9 TS_FC_ADDR_RANGE 10 TS_SECLABEL 11-240 Unassigned 241-255 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 Reserved 1 CFG_REQUEST 2 CFG_REPLY 3 CFG_SET 4 CFG_ACK 5-127 Unassigned 128-255 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov Attribute Types with an "*" may be multi-valued on return only if multiple values were requested. 0 Reserved 1 INTERNAL_IP4_ADDRESS YES* 0 or 4 octets 2 INTERNAL_IP4_NETMASK NO 0 or 4 octets 3 INTERNAL_IP4_DNS YES 0 or 4 octets 4 INTERNAL_IP4_NBNS YES 0 or 4 octets 5 Reserved 6 INTERNAL_IP4_DHCP YES 0 or 4 octets 7 APPLICATION_VERSION NO 0 or more 8 INTERNAL_IP6_ADDRESS YES* 0 or 17 octets 9 Reserved 10 INTERNAL_IP6_DNS YES 0 or 16 octets 11 Reserved 12 INTERNAL_IP6_DHCP YES 0 or 16 octets 13 INTERNAL_IP4_SUBNET YES 0 or 8 octets 14 SUPPORTED_ATTRIBUTES NO Multiple of 2 15 INTERNAL_IP6_SUBNET YES 17 octets 16 MIP6_HOME_PREFIX YES 0 or 21 octets 17 INTERNAL_IP6_LINK NO 8 or more 18 INTERNAL_IP6_PREFIX YES 17 octets 19 HOME_AGENT_ADDRESS NO 16 or 20 20 P_CSCF_IP4_ADDRESS YES 0 or 4 octets 21 P_CSCF_IP6_ADDRESS YES 0 or 16 octets 22 FTT_KAT NO 2 octets TS 24.302 12.6.0 23 EXTERNAL_SOURCE_IP4_NAT_INFO NO 0 or 6 TS 29.139 24 TIMEOUT_PERIOD_FOR_LIVENESS_CHECK NO 0 or 4 octets TS 24.302 13.4.0 25 INTERNAL_DNS_DOMAIN YES 0 or more 26 INTERNAL_DNSSEC_TA YES 0 or more 27 ENCDNS_IP4 YES 0 or more 28 ENCDNS_IP6 YES 0 or more 29 ENCDNS_DIGEST_INFO YES 0 or more 30-16383 Unassigned 16384-32767 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 Reserved 1 IPv4 address of the VPN gateway 2 IPv6 address of the VPN gateway 3 FQDN of the VPN gateway 4-240 Unassigned 241-255 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 Reserved 1 Maximum Context Identifier (MAX_CID) TV 2 ROHC Profile (ROHC_PROFILE) TV 3 ROHC Integrity Algorithm (ROHC_INTEG) TV 4 ROHC ICV Length in bytes (ROHC_ICV_LEN) TV 5 Maximum Reconstructed Reception Unit (MRRU) TV 6-16383 Unassigned 16384-32767 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 Reserved 1 PACE 2 AugPAKE 3 Secure PSK Authentication 4-1023 Unassigned 1024-65535 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov To find out requirement levels for IKEv2 hash algorithms, see . 0 Reserved 1 SHA1 2 SHA2-256 3 SHA2-384 4 SHA2-512 5 Identity 6 STREEBOG_256 7 STREEBOG_512 8-1023 Unassigned 1024-65535 Reserved for Private Use 1-127 Expert Review 128-255 Private Use Tero Kivinen, Valery Smyslov 0 Reserved 1 PPK_ID_OPAQUE 2 PPK_ID_FIXED 3-127 Unassigned 128-255 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 Reserved 1 GSA_KEY_LIFETIME TLV NO GIKE_UPDATE, AH, ESP 2 GSA_INITIAL_MESSAGE_ID TLV NO GIKE_UPDATE 3 GSA_NEXT_SPI TLV YES GIKE_UPDATE, AH, ESP 4-16383 Unassigned 16384-32767 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 Reserved 1 GWP_ATD TV NO 2 GWP_DTD TV NO 3 GWP_SENDER_ID_BITS TV NO 4-16383 Unassigned 16384-32767 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 Reserved 1 SA_KEY TLV YES
NO GIKE_UPDATE
AH, ESP
2-16383 Unassigned 16384-32767 Reserved for Private Use Expert Review Tero Kivinen, Valery Smyslov 0 Reserved 1 WRAP_KEY TLV YES 2 AUTH_KEY TLV NO 3 GM_SENDER_ID TLV YES 4-16383 Unassigned 16384-32767 Reserved for Private Use Dongwook Kim mailto:dongwook.kim&etsi.org 2026-01-15 Kimmo Kymalainen mailto:kimmo.kymalainen&etsi.org 2015-12-02 Matt Ball mailto:matt.ball&ieee.org 2007-10-11