API Resources
Theme

Choose how MSRBot.io looks on this device.

Auto (match system) Light mode Dark mode

Preference is stored in this browser only.

IETF RFC 9867
[ACTIVE]

Mixing Preshared Keys in the IKE_INTERMEDIATE and CREATE_CHILD_SA Exchanges of the Internet Key Exchange Protocol Version 2 (IKEv2) for Post-Quantum Security

Metadata

Publisher
IETF
Doc Type
Standard
Pages
12
Abstract
An Internet Key Exchange Protocol Version 2 (IKEv2) extension defined in RFC 8784 allows IPsec traffic to be protected against someone storing VPN communications and decrypting them later, when (and if) a Cryptographically Relevant Quantum Computer (CRQC) is available. The protection is achieved by means of a Post-quantum Preshared Key (PPK) that is mixed into the session keys calculation. However, this protection does not cover an initial IKEv2 Security Association (SA), which might be unacceptable in some scenarios. This specification defines an alternative way to provide protection against quantum computers, which is similar to the solution defined in RFC 8784, but it also protects the initial IKEv2 SA. RFC 8784 assumes that PPKs are static and thus they are only used when an initial IKEv2 SA is created. If a fresh PPK is available before the IKE SA expires, then the only way to use it is to delete the current IKE SA and create a new one from scratch, which is inefficient. This specification defines a way to use PPKs in active IKEv2 SAs for creating additional IPsec SAs and rekey operations.
Publication Date
2025-11-01
Status Note
Proposed Standard
DOI
10.17487/RFC9867
Link
https://doi.org/10.17487/RFC9867
Author(s)
Valery Smyslov
Keyword(s)
IKE, Post-quantum Cryptography, PPK
Latest version of IETF RFC 9867

Document Versions — IETF RFC 9867

  • ▶ IETF RFC 9867 (2025-11-01)
    THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

Bibliographic Reference(s)

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9867.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree
Reference this Doc

Plain text (ISO 690 compliant)

Preview:
IETF RFC 9867, Mixing Preshared Keys in the IKE_INTERMEDIATE and CREATE_CHILD_SA Exchanges of the Internet Key Exchange Protocol Version 2 (IKEv2) for Post-Quantum Security. Available at https://doi.org/10.17487/RFC9867
Snippet:
IETF RFC 9867, Mixing Preshared Keys in the IKE_INTERMEDIATE and CREATE_CHILD_SA Exchanges of the Internet Key Exchange Protocol Version 2 (IKEv2) for Post-Quantum Security. Available at https://doi.org/10.17487/RFC9867

HTML (ISO 690 compliant)

Preview:
IETF RFC 9867, Mixing Preshared Keys in the IKE_INTERMEDIATE and CREATE_CHILD_SA Exchanges of the Internet Key Exchange Protocol Version 2 (IKEv2) for Post-Quantum Security. Available at https://doi.org/10.17487/RFC9867
Snippet:
<span class="citation"><cite>IETF RFC 9867</cite>, Mixing Preshared Keys in the IKE_INTERMEDIATE and CREATE_CHILD_SA Exchanges of the Internet Key Exchange Protocol Version 2 (IKEv2) for Post-Quantum Security. Available at <a href="https://doi.org/10.17487/RFC9867" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9867</a></span>

SMPTE Icon SMPTE's HTML Pub

Preview:
IETF RFC 9867, Mixing Preshared Keys in the IKE_INTERMEDIATE and CREATE_CHILD_SA Exchanges of the Internet Key Exchange Protocol Version 2 (IKEv2) for Post-Quantum Security
doi: 10.17487/RFC9867
url: https://doi.org/10.17487/RFC9867
Snippet:
<li>
<cite id="bib-rfc9867">IETF RFC 9867</cite>, Mixing Preshared Keys in the IKE_INTERMEDIATE and CREATE_CHILD_SA Exchanges of the Internet Key Exchange Protocol Version 2 (IKEv2) for Post-Quantum Security
<span class="doi">10.17487/RFC9867</span>
</li>

Referenced By