Summary

  • RFC 2409 Quick Mode protected three messages with an existing Phase 1 ISAKMP SA. HASH(1) and HASH(2) authenticated proposals and nonces; HASH(3) gave the responder a final liveness proof. The specified base exchange contained no fourth Quick Mode acknowledgment.
  • The transcript could establish negotiated key material without proving that both endpoints installed compatible SAs, attached the intended selectors, processed protected packets or delivered an application result. Those claims required separate local and runtime receipts.

The most revealing packet in Quick Mode carried almost nothing. Its encrypted body contained HASH(3). No new proposal followed it. No new nonce followed it. No fourth base Quick Mode message returned from the responder.

That economy was deliberate. By the time the third message arrived, the exchange had already carried the proposed Security Associations, the initiator’s nonce, the responder’s selection and nonce, and—when requested—fresh Diffie-Hellman values and client identities. The final hash closed a cryptographic conversation. It did not make the conversation symmetrical as evidence.

RFC 2409 assembled IKE from pieces that RFC 2408 had intentionally left open. ISAKMP supplied the message framework. The IPsec DOI supplied domain-specific proposal meanings. IKE supplied concrete exchanges, authentication choices, key derivation and rules for protecting later negotiations. The result had two phases because one expensive authenticated channel could support many later SA negotiations.

Phase 1 established the ISAKMP SA. Main Mode had to be implemented; Aggressive Mode was recommended. Both produced authenticated keying material from an ephemeral Diffie-Hellman exchange, but they arranged identity and protection differently. Quick Mode belonged only to Phase 2. It borrowed the authenticated Phase 1 context and used it to negotiate non-ISAKMP SAs, including the SAs that AH or ESP would later consume.

The parent and child state had separate coordinates. The Initiator Cookie and Responder Cookie pair named the ISAKMP SA. A new Message ID named one Quick Mode instance. Because each instance derived an independent first initialization vector from the final Phase 1 ciphertext block and that Message ID, several Quick Modes could proceed concurrently without sharing one advancing IV chain.

That Message ID did not authenticate the Phase 2 message by itself. It selected the state in which authentication could be checked. The distinction matters because the same four octets appear inside the hash inputs. A lookup key became cryptographically bound to the rest of the transcript, but the field’s scope did not expand into identity, authority or installation.

The first Quick Mode message placed a HASH immediately after the encrypted header, followed immediately by an SA payload. It carried HASH(1), the offered SAs and the initiator nonce Ni; it could also carry a Quick Mode key exchange and client-identity selectors. HASH(1) covered the Message ID and the complete message after the hash, including payload headers and excluding encryption padding.

That construction gave the responder a bounded claim. Someone with the authenticated Phase 1 keying state had formed this particular Phase 2 proposal under this Message ID, with this nonce and these optional identities. It did not say that the responder’s local policy would accept the proposal. It did not say that an IPsec SA already existed.

The second message returned HASH(2), the selected SA and the responder nonce Nr, with matching optional material when present. HASH(2) added the initiator nonce before the rest of the response. RFC 2409 described that addition as a liveness proof. The response therefore bound the responder’s choice to the initiator’s challenge and to the authenticated parent state.

From the initiator’s viewpoint, successful decryption and verification of the second message established a strong but limited fact: the responder holding the Phase 1 state had answered this Quick Mode instance using the initiator’s nonce and had supplied a fresh nonce of its own. The initiator could derive the same candidate keying material if the parties had interpreted the proposal consistently.

The third message was HDR*, HASH(3). The hash input began with one zero octet and then joined the Message ID, Ni and Nr. The responder could verify that the initiator had received Nr and possessed the authenticated state needed to form the final value. That was the final liveness edge in base Quick Mode.

The direction of that edge is easy to lose in a green status badge. The responder receives HASH(3); the initiator sends it. When verification succeeds, the responder learns something about the initiator’s progress. The base transcript gives the initiator no fourth Quick Mode message proving that the responder received or accepted the third.

This is an inference from the specified three-message sequence, not a quotation that RFC 2409 calls the exchange defective. A protocol can be correct without producing every receipt an operator later wants. Retransmission rules, protected traffic, implementation state and RFC 2408’s optional Commit machinery could supply additional signals. None changes what the base Quick Mode transcript itself contains.

The missing fourth edge also prevents a stronger leap. Even a fourth network acknowledgment would not, by itself, prove that two kernels installed compatible packet-processing state. Negotiation lived in an IKE process. Runtime AH or ESP processing depended on local Security Association databases, selectors, lifetimes, sequence state, routes, interfaces and sometimes hardware offload. A message receipt is not a system-call receipt.

RFC 2409’s key derivation makes the separation clearer. The two nonces refreshed material and stopped replayed messages from creating bogus SAs. Without a Quick Mode KE payload, KEYMAT came from SKEYID_d, the protocol, SPI, Ni and Nr. The new keys were fresh with respect to the nonces, but this base construction did not give the Phase 2 keys perfect forward secrecy independent of the Phase 1 exponentiation.

When the parties included the optional KE payload, they performed another Diffie-Hellman exchange and mixed its shared secret into KEYMAT. That supplied PFS for the generated Phase 2 keys. Implementations had to support the option even though an exchange did not have to use it.

PFS is a cryptographic history property. It limits what later compromise of long-term or parent material can expose. It is not evidence that a write to the SAD succeeded, that a selector entered the SPD, that both directions used the same transforms, or that an application received data. A system that labels PFS as “tunnel installed” merges two unrelated proofs.

The optional client identities reveal another boundary. IDci and IDcr could identify the traffic endpoints on whose behalf the IKE peers negotiated. If those identities appeared, they had to apply consistently to every SA in the negotiation. The authenticated Phase 1 peer and the client traffic subject could therefore be related without being identical.

An audit that records only “peer authenticated” misses the authorization step. A gateway credential might authenticate the device running IKE, while the Quick Mode IDs describe a subnet, host or protocol selector. Local policy still decided whether that gateway could establish this traffic relation. The transcript authenticated the offered and selected fields; it did not author the receiving organization’s rule.

The proposal could contain bundles of SAs, transforms and SPIs. Consistency rules applied across every proposal when Quick Mode carried a KE payload or client identities. Those rules prevented one transcript from quietly applying incompatible group or selector assumptions to different members of the bundle.

Consistency at the message layer still stopped before the kernel. The responder could select an acceptable transform and form HASH(2). The initiator could verify it and send HASH(3). Either endpoint could then fail on memory, policy reconciliation, lifetime conversion, device programming, route binding or selector installation. RFC 2409 did not put those local receipts into HASH(3).

The IV rules make the implementation boundary visible. Quick Mode’s first IV was derived from the final Phase 1 CBC output block and the Phase 2 Message ID. Later messages chained from the prior ciphertext block inside that Quick Mode. Other concurrent exchanges derived independent chains.

RFC 2409 warned implementations not to update a running IV merely because a ciphertext arrived. The decrypted message had to pass a basic sanity check and actually advance the IKE state machine. Otherwise a retransmission or forged message carrying valid cookies could push the cipher state out of sync.

Receiving, decrypting, validating and advancing were therefore already four distinguishable events inside IKE. Installing an IPsec SA and observing a protected packet added at least two more. A useful record must not compress all six into one timestamp called “connected”.

The protocol’s own retransmission environment explains why. IKE used UDP and inherited ISAKMP timeout and retransmit behavior. A final outbound message could be lost. The sender might retransmit because it saw no protected traffic or other sign of progress. The receiver had to distinguish a retransmission from a new state advance. The same byte sequence could be valid cryptographically while being old operationally.

That is why the third hash is best understood as a scoped receipt. It authenticates a precise construction under SKEYID_a and the parent SA. It proves knowledge of both nonces to the responder. It closes the defined Quick Mode exchange. It is not a receipt signed by the responder after local installation, and it contains no packet counter or application observation.

Lu Heng’s reality-layer lens turns the sequence into an evidence map. The Message ID belongs to correlation. HASH(1) through HASH(3) belong to authenticated transcript progression. KEYMAT belongs to derivation. A policy match belongs to local authority. An SAD or SPD mutation belongs to running code. An ESP counter belongs to packet processing. A service check belongs to the user-visible result.

The agency problem appears at each boundary. Protocol authors defined the calculation. Credential administrators bound Phase 1 identities. Security teams owned authorization. The IKE daemon negotiated. The kernel or accelerator installed. Network operations observed packets. An application owner judged usefulness. No agent could truthfully speak for every later agent simply because its own step succeeded.

Minimum specification has the same consequence. The common standard needed to specify interoperable messages and calculations. It did not need to nationalize each host’s policy, driver, route table or audit store. Local freedom was preserved, but so was local responsibility for evidence that the common transcript could not carry.

Running-code primacy supplies the operational remedy. Preserve the cookies and Message ID, but join them to Phase 1 credential fingerprints, authentication results, Ni, Nr, transcript-hash verification, selected proposals, KEYMAT generation identifiers, policy revision, local install calls, runtime SPIs and selectors, packet counters and an application test. The joins are the proof.

That record also protects incident analysis from hindsight. If one side has verified HASH(2) and emitted HASH(3) while the other side never records the third message, the failure belongs before symmetric transcript completion. If both daemons close Quick Mode but one kernel has no matching SA, the failure belongs at installation. If both kernels count protected packets but the application fails, the problem lies later still.

RFC 2409 was published in November 1998. RFC 4109 later updated the algorithm requirements for IKEv1. RFC 4306 replaced the separated RFC 2407, RFC 2408 and RFC 2409 family with IKEv2 in 2005. RFC 7296 later became the IKEv2 Internet Standard. In 2023 the IESG moved IKEv1 to Historic, and RFC 9395 deprecated IKEv1 and closed related registries.

Historical status does not weaken the lesson. Modern systems still turn an authenticated control-plane exchange into a claim about data-plane readiness. The third hash shows why that shortcut is unsafe. It closed Quick Mode. It did not confirm both kernels.

Sources