Internet Key Exchange IKE

1
Internet Key Exchange IKE

• RFC 2409
• Services
• Constructs shared authenticated keys
• Establishes shared security parameters
• Common SAs between IPSec peers
• Relies on the following RFCs
• RFC 2408 ISAKMP
• RFC 2407 IPSec DOI
• RFC 2412 OAKLEY Key Determination

2
IKE

• Phase 1
• Creates an ISAKMP SA
• IKE has a policy database weighted in order of
  preference
• Phase 2
• Creates an IPSec SA
• Done under the protection of the Phase 1 IKE SA

3
IKE Phase 1

• IKE Policy Database
• Policies or protection suites
• IKE SA consists of specific choices for the
  following
• Encryption algorithm
• Hash Algorithm
• Diffie-Hellman group
• Authentication method

4
IKE Phase 1

• IKE SA
• Used to create the ISAKMP SA
• Always uses a Diffie-Hellman exchange to generate
  keys
• There Are five parameter groups permitted
• 3 exponential based
• 2 elliptical curve based

5
IKE Phase 2

• Creates IPSec SA
• Uses IKE SA
• IPSec keys are derived from the IKE SA secret
  state