According to RFC 2409:
CKY-I and CKY-R are the Initiator's cookie and the Responder's cookie, respectively, from the ISAKMP header.
Each CKY is a 64 bit value that is included in each ISAKMP Header in the Phase1 and Phase2 negotiation, and future ISAKMP informational exchanges. And they are also used in the math for key generation.
Also in the ISAKMP RFC, I see that the Cookies are used to Identify the ISAKMP Security Association (SA):
Per the base ISAKMP document, the ISAKMP SA is identified by the Initiator's cookie followed by the Responder's cookie
(although I'm not sure what "base ISAKMP document" they are referring to)
Given all these describe what the CKY-I and CKY-R values are, I am curious to understand why they exist. Effectively, what is the functional role they play?
If they solely exist to identify the SA, why not simply use an SPI value like IPsec does? Or, why not simply pick a random arbitrary value to use and not include it in all the key material calculation?
Bonus question: “How” are they created? I imagine they are random values, but I couldn't find any confirmation related to that in the RFCs.