2 message are negotiated during the implementation of the IKEv2 SA. 7.1.2.2.13. CP block The configuration (CP) block is used to exchange configuration information between the two end points. In the case of an ESP/AH security association between a host and a security gateway, the host can request information concerning a host in the protected network. 7.1.2.2.14. EAP block The extensible authentication protocol (EAP) block enables the use of EAP in IKEv2 message for authentication. 7.1.3. Procedure 7.1.3.1. IKE_SA_INIT exchange The first exchange, IKE_SA_INIT, negotiates cryptographic algorithms and random numbers and executes a Diffie-Hellman exchange in order to create an IKE security association. 138 Wi-Fi Integration to the 4G Mobile Network The initiator generates an IKE message containing the header (HDR) and the SAil, KEi and Ni blocks. The header contains the initiator's SPI, version numbers and flags. The SAil block contains the cryptographic algorithms proposed by the initiator for the IKE security association. The KEi block includes the Diffie-Hellman group and public value. The Ni block displays the initiator's random number (Figure 7.7). HDR, SAil, KEi, Ni Initiator HDR, SArl, KEr, Nr, [CERTREQ] Responder Figure 7.7. IKE_SA_INIT exchange The responder chooses a cryptograph series from the initiator's proposals and includes it in the SAr1 block. It completes the exchange of Diffie- Hellman keys with the KEr block. It sends its random number in the Nr block (Figure 7.7). It can possibly communicate a list of certificate authorities in the CERTREQ block. At this stage of the negotiation, each end point can generate the SKEYSEED key. The keys used for encryption and integrity of IKE messages are produced by the SKEYSEED key and are known as SK e (encryption) and SK_a (integrity). Message protection involves only the blocks; the header is not included. The two different directions of traffic use different keys. The keys used to protect messages from the initiator are SK ai and SK_ei. The keys used to prot