I am studying & configuring IPSEC ikev1 and in between i am analysing the wireshark captures. I am using the linux kernel for TCP/IP stack and user-space i took ipsec-tools.

In the first two packet exchanges initiator is offering the proposals & responder will respond to the supported proposal.

Next two packet exchanges(packet 3[initiator] & 4[responder]) will perform DH key exchange.Here how the responder will came to know that which prime number the initiator uses & how it will be exchanged.


It's in the SA payload of the initial packets.

It's attribute type 4 within the SA payload; in Main Mode of IKE (which is what you're looking at) the initiator will propose a list of groups, and the responder will pick one and send it back its selection in packet 2.

Now, what they exchange is a short integer value; both sides are expected to know the translation between the short values (current standard values are between 1 and 30) and the actual DH (or ECDH) group. See this page for pointers to the definitions of the current standard groups.

  • $\begingroup$ Yeah i seen it in wireshark capture, In Transform IKE Attribute Type: Group Description 1024-bit MODP. There what it specifies? In this expression A=g(pow)a mod p. The g & p are generator and prime number respectively, how they choosen both same at initiator & responder. $\endgroup$
    – Kumar2080
    Mar 3 '17 at 10:22
  • $\begingroup$ @Kumar2080: if an IKE implementation supports group 2, it is expected to know that, for that group, $g=2$, and $p$ is the specific value listed in section 6.2 of RFC2409. $\endgroup$
    – poncho
    Mar 10 '17 at 4:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.