AAA and Network Security for Mobile Access: Radius, Diameter, EAP, PKI and IP Mobility

4.3. Internet Key Exchange for IPsec

During the discussion of key management mechanisms in Chapter 3, we briefly mentioned the IKE. IKE is a method that is based on the Diffie-Hellman key agreement concepts, even though it is the result of a great many improvements to the Diffie-Hellman agreement as a protocol. Like the Diffie-Hellman agreement, IKE is a peer-to-peer key agreement mechanism; no central servers are directly involved in the IKE conversation. However, compared to the Diffie-Hellman agreement, IKE has a less generic deployment base, since its main purpose is to facilitate the use of IPsec. With high likelihood, any IPsec implementation bundle includes IKE as the key exchange mechanism to establish SAs. Another difference between DH and IKE is that, as we will see later on, the purpose of the DH exchange within IKE is to establish shared secrets, that will be used to merely protect the IPsec SA negotiation, following the DH exchange. Those shared secrets are not used for encryption of the actual session data. The actual session data are protected by the IPsec SAs that are established during the IKE conversation.

4.3.1. IKE Specifications

IKE is one of those protocols that, despite their large deployment base, are very rarely treated in books and literature. This may be due to the complexity of its documentation; just understanding the relation between IKE documentations will take a while, let alone understanding the details of each. We will explain that relation to ...