11.11. IKEv2 decryption table
Prev | Chapter 11. Customizing Wireshark | Next

## 11.11. IKEv2 decryption table

Wireshark can decrypt Encrypted Payloads of IKEv2 (Internet Key Exchange version 2) packets if necessary information is provided. Note that you can decrypt only IKEv2 packets with this feature. If you want to decrypt IKEv1 packets or ESP packets, edit ISAKMP protocol preference IKEv1 Decryption Table or ESP protocol preference ESP SAs respectively.

This is handled by a UAT, as described in Section 11.7, “User Accessible Tables”, with the following fields:

Initiator’s SPI
  Initiator’s SPI of the IKE_SA. This field takes hexadecimal string without “0x” prefix and the length must be 16 hex chars (represents 8 octets).
Responder’s SPI
  Responder’s SPI of the IKE_SA. This field takes hexadecimal string without “0x” prefix and the length must be 16 hex chars (represents 8 octets).
SK_ei
  Key used to encrypt/decrypt IKEv2 packets from initiator to responder. This field takes hexadecimal string without “0x” prefix and its length must meet the requirement of the encryption algorithm selected.
SK_er
  Key used to encrypt/decrypt IKEv2 packets from responder to initiator. This field takes hexadecimal string without “0x” prefix and its length must meet the requirement of the encryption algorithm selected.
Encryption Algorithm
  Encryption algorithm of the IKE_SA.
SK_ai
  Key used to calculate Integrity Checksum Data for IKEv2 packets from responder to initiator. This field takes hexadecimal string without “0x” prefix and its length must meet the requirement of the integrity algorithm selected.
SK_ar
  Key used to calculate Integrity Checksum Data for IKEv2 packets from initiator to responder. This field takes hexadecimal string without “0x” prefix and its length must meet the requirement of the integrity algorithm selected.
Integrity Algorithm
  Integrity algorithm of the IKE_SA.

Prev | Up | Next
11.10. IEEE 802.11 WLAN Decryption Keys | Home | 11.12. Object Identifiers