RFC 4868 · PROPOSED STANDARD · 2007

Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec

Overview

RFC 4868, “Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec”, is a Proposed Standard document published in May 2007 by S. Kelly, S. Frankel. The canonical text is published by the RFC Editor.

Abstract

This specification describes the use of Hashed Message Authentication Mode (HMAC) in conjunction with the SHA-256, SHA-384, and SHA-512 algorithms in IPsec. These algorithms may be used as the basis for data origin authentication and integrity verification mechanisms for the Authentication Header (AH), Encapsulating Security Payload (ESP), Internet Key Exchange Protocol (IKE), and IKEv2 protocols, and also as Pseudo-Random Functions (PRFs) for IKE and IKEv2. Truncated output lengths are specified for the authentication-related variants, with the corresponding algorithms designated as HMAC-SHA-256-128, HMAC-SHA-384-192, and HMAC-SHA-512-256. The PRF variants are not truncated, and are called PRF-HMAC-SHA-256, PRF-HMAC-SHA-384, and PRF-HMAC-SHA-512. [STANDARDS-TRACK]

Abstract as published in the RFC, via rfc-editor.org.

What “Proposed Standard” means

An entry-level standards-track specification: stable, peer-reviewed and a solid basis for implementation, though it may still evolve before becoming an Internet Standard.

Read this RFC

The canonical text of RFC 4868 is hosted at rfc-editor.org. Available in TXT,HTML.

Other RFCs from 2007

Who Is Online

In total there are 54 users online: 0 registered, 50 guests and 4 bots.

Most users ever online was 1,226 on 13 Jun 2026, 3:56 am.

Bots: Facebook Other Bot Other Crawler SemrushBot

Users active in the past 15 minutes. Total registered members: 354