A Proposal to Improve IKEv2 negotiation

Abstract

IKEv2 is a new key exchange protocol in the IPsec network and IKEv2 includes a method to detect when it is under denial-of-service (DoS) attack. In case IKEv2 is not under DoS attack it can use initial exchange, but when IKEv2 is under DoS attack cookie negotiation may be used. Cookie negotiation adds an extra round trip to the initial exchange, and protection that is easy to pass by. The resistance to DoS attacks is actually weaker in IKEv2 than in JFK or full-SIGMA in different networks. This paper presents improved cookie negotiation to remedy this weakness. The proposed cookie negotiation delays the responder's calculation work to the last second and computational load is kept as low as possible.