network protocols handbook.pdf

115Protocols GuideSecurity and VPN - Secured Routing ProtocolsProtocol NameIPsec IKE: Internet Key ExchangeProtocolProtocol DescriptionInternet Key Exchange (IKE) Protocol, a key protocol in the IPsecarchitecture, is a hybrid protocol using part of Oakley andpart of SKEME in conjunction with ISAKMP to obtain authenticatedkeying material for use with ISAKMP, and for other securityassociations such as AH and ESP for the IPsec DOI.ISAKMP provides a framework for authentication and key exchangebut does not define them. ISAKMP is designed to bekey exchange independent and supports many different key exchanges.The Internet Key Exchange (IKE) is one of a series ofkey exchanges—called “modes”.IKE processes can be used for negotiating virtual private networks(VPNs) and also for providing a remote user from a remotesite (whose IP address need not be known beforehand)access to a secure host or network. Client negotiation is supported.Client mode is where the negotiating parties are notthe endpoints for which security association negotiation is takingplace. When used in client mode, the identities of the end partiesremain hidden.IKE implementations support the following attribute values:• DES in CBC mode with a weak, and semi-weak, keycheck• MD5 and SHA.• Authentication via pre-shared keys.• MODP over default group number one.Sponsor SourceIP IKE is defined by IETF (http://www.ietf.org) in RFC 2409.Referencehttp://www.javvin.com/protocol/rfc2409.pdfThe Internet Key Exchange (IKE)In addition, IKE implementations support: 3DES for encryption;Tiger for hash; the Digital Signature Standard, RSA signaturesand authentication with RSA public key encryption; and MODPgroup number 2. IKE implementations MAY support any additionalencryption algorithms and MAY support ECP and EC2Ngroups.The IKE modes must be implemented whenever the IPsec DOIis implemented. Other DOIs MAY use the modes describedhere.Protocol StructureIKE messages are a combination of ISAKMP header and SKEMEand Oakley fields. The specific message format depends on themessage phases and modes. For more details, see the referencedocuments.Related protocolsIPsec, ESP, AH, DES, AES, DOI, HMAC, HMAC-MD5, HMAC-SHA, PKI, IP, IPv6, ICMP