Deprecation of the Internet Key Exchange Version 1 (IKEv1) Protocol and Obsoleted Algorithms
updates
Extracted elements (15)
IKEv1 is deprecated because development ceased over a decade ago, leaving unmaintained code with security risks; IKEv1 systems are vulnerable to packet amplification attacks (CVE-2016-5361); and the de facto negotiated algorithms consist of dated or deprecated choices like AES-CBC, SHA1, and Diffie-Hellman groups 1 or 2.
IKEv1's use of Preshared Keys (PSKs) protected against quantum-computer-based attacks, but IKEv2 updated PSK usage to improve error reporting at the expense of post-quantum security. Systems requiring post-quantum security should migrate to IKEv2 Post-quantum Preshared Keys (PPKs) per RFC 8784.
RFCs 8221 and 8247 previously avoided explicitly deprecating aged, unused algorithms by leaving them in a 'MAY be used' state through omission. RFC 9395 explicitly deprecates these algorithms because they are no longer advised, even though no known attacks exist against them, to eliminate ambiguity and reduce downgrade attack surface.
Some IKEv1 implementations support Labeled IPsec (negotiating an additional Security Context selector to the SPD), but this was never standardized in IKEv1. IKEv1 systems requiring Labeled IPsec should migrate to IKEv2 systems supporting Labeled IPsec.
The Group Domain of Interpretation (GDOI) protocol (RFC 6407), which is based on IKEv1, defines support for Multicast Group SAs. For IKEv2, equivalent Group SA and multicast support (G-IKEv2) was in progress at time of publication.
IKEv2 implementations SHOULD NOT directly import IKEv1 configurations without updating the cryptographic algorithms used.
The following encryption algorithms are deprecated for IKEv2 use: RC5, IDEA, CAST, Blowfish, and the unspecified 3IDEA, ENCR_DES_IV64, and ENCR_DES_IV32.
The integrity algorithm HMAC-MD5-128 (AUTH_HMAC_MD5_128) is deprecated for IKEv2 use. Additionally AUTH_HMAC_SHA1_160 is also deprecated.
The PRF algorithm PRF_HMAC_TIGER is deprecated for IKEv2 use.
Encryption algorithm entries marked DEPRECATED in Transform Type 1: ENCR_DES_IV64 (1), ENCR_DES (2, per RFC 8247), ENCR_RC5 (4), ENCR_IDEA (5), ENCR_CAST (6), ENCR_BLOWFISH (7), ENCR_3IDEA (8), ENCR_DES_IV32 (9).
IANA added a 'Status' column to four IKEv2 Transform Type Values registries: Transform Type 1 (Encryption Algorithm), Transform Type 2 (PRF), Transform Type 3 (Integrity Algorithm), and Transform Type 4 (Key Exchange Method Transform IDs), enabling deprecation status to be tracked.
IANA closed the 'Internet Key Exchange (IKE) Attributes' and '"Magic Numbers" for ISAKMP Protocol' registries, adding a note that all listed registries are closed per RFC 9395 and changing registration procedures to 'Registry closed'.
Key exchange method entries marked DEPRECATED in Transform Type 4: 768-bit MODP Group (1) and 1024-bit MODP Group with 160-bit Prime Order Subgroup (22), both per RFC 8247.
PRF algorithm entries marked DEPRECATED in Transform Type 2: PRF_HMAC_MD5 (1, per RFC 8247) and PRF_HMAC_TIGER (3, per RFC 9395). Integrity algorithm entries marked DEPRECATED in Transform Type 3: AUTH_HMAC_MD5_96 (1), AUTH_DES_MAC (3), AUTH_KPDK_MD5 (4) per RFC 8247; AUTH_HMAC_MD5_128 (6) and AUTH_HMAC_SHA1_160 (7) per RFC 9395.
There are only security benefits to deprecating IKEv1 and using IKEv2. Deprecated algorithms have long been in disuse; their non-support in implementations simplifies those implementations and reduces accidental use through misconfiguration or downgrade attacks.