Skip to main content

RFC 9867 - Mixing Preshared Keys in the IKE_INTERMEDIATE and CREATE_CHILD_SA Exchanges of the Internet Key Exchange Protocol Version 2 (IKEv2) for Post-Quantum Security

  • Status: Proposed Standard
  • Published: November 2025
  • Stream: IETF
  • Pages: 12
  • Errata: No Errata

Abstract​

An Internet Key Exchange Protocol Version 2 (IKEv2) extension defined in RFC 8784 protects IPsec traffic against future decryption by mixing a Post-quantum Preshared Key (PPK) into session key calculation. This specification defines an alternative that also protects the initial IKEv2 Security Association (SA) and allows fresh PPKs to be used in active IKEv2 SAs for additional IPsec SAs and rekey operations.

Last updated on