Internet Key Exchange

Key takeaways

Internet Key Exchange belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Internet Key Exchange to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Internet Key Exchange from memory before moving on to harder problems.

Reference excerpt

In computing, Internet Key Exchange (IKE, versioned as IKEv1 and IKEv2) is the protocol used to set up a security association (SA) in the IPsec protocol suite. IKE builds upon the Oakley protocol and ISAKMP. IKE uses X.509 certificates for authentication ‒ either pre-shared or distributed using DNS (preferably with DNSSEC) ‒ and a Diffie–Hellman key exchange to set up a shared session secret from which cryptographic keys are derived. A IETF draft is currently being written to provide a quantum-resistant key establishment using ML-KEM. In addition, a security policy for every peer which will connect must be manually maintained.

History The Internet Engineering Task Force (IETF) originally defined IKE in November 1998 in a series of publications (Request for Comments) known as RFC 2407, RFC 2408 and RFC 2409:

RFC 2407 defined the Internet IP Security Domain of Interpretation for ISAKMP. RFC 2408 defined the Internet Security Association and Key Management Protocol (ISAKMP). RFC 2409 defined the Internet Key Exchange (IKE). RFC 4306 updated IKE to version two (IKEv2) in December 2005. RFC 4718 clarified some open details in October 2006. RFC 5996 combined these two documents plus additional clarifications into the updated IKEv2, published in September 2010. A later update upgraded the document from Proposed Standard to Internet Standard, published as RFC 7296 in October 2014. The parent organization of the IETF, the Internet Society (ISOC), has maintained the copyrights of these standards as freely available to the Internet community.

Architecture Most IPsec implementations consist of an IKE daemon that runs in user space and an IPsec stack in the kernel that processes the actual IP packets. User-space daemons have easy access to mass storage containing configuration information, such as the IPsec endpoint addresses, keys and certificates, as required. Kernel modules, on the other hand, can process packets efficiently and with minimum overhead—which is important for performance reasons. The IKE protocol uses UDP packets, usually on port 500, and generally requires 4–6 packets with 2–3 round trips to create an ISAKMP security association (SA) on both sides. The negotiated key material is then given to the IPsec stack. For instance, this could be an AES key, information identifying the IP endpoints and ports that are to be protected, as well as what type of IPsec tunnel has been created. The IPsec stack, in turn, intercepts the relevant IP packets if and where appropriate and performs encryption/decryption as required. Implementations vary on how the interception of the packets is done—for example, some use virtual devices, others take a slice out of the firewall, etc. IKEv1 consists of two phases: phase 1 and phase 2.

IKEv1 phases IKE phase one's purpose is to establish a secure authenticated communication channel by using the Diffie–Hellman key exchange algorithm to generate a shared secret key to encrypt further IKE communications. This negotiation results in one single bi-directional ISAKMP security association. The authentication can be performed using either pre-shared key (shared secret), signatures, or public key encryption. Phase 1 operates in either Main Mode or Aggressive Mode. Main Mode protects the identity of the peers and the hash of the shared key by encrypting them; Aggressive Mode does not. During IKE phase two, the IKE peers use the secure channel established in Phase 1 to negotiate Security Associations on behalf of other services like IPsec. The negotiation results in a minimum of two unidirectional security associations (one inbound and one outbound). Phase 2 operates only in Quick Mode.

Problems with IKE Originally, IKE had numerous configuration options but lacked a general facility for automatic negotiation of a universally supported default case. As a result, both endpoints needed to exactly agree on every parameter of the security association—such as encryption algorithms, key exchange methods, and lifetimes—or the connection would fail. This led to frequent interoperability issues between different vendors' implementations. Troubleshooting was further complicated by limited or cryptic debug output in many implementations. The IKEv1 specifications also permitted a significant degree of interpretation, sometimes bordering on design flaws. One example is Dead Peer Detection (DPD), which was implemented inconsistently across vendors. Even with correctly matched configurations, this could result in negotiation failures or dropped tunnels.

Improvements with IKEv2

The IKEv2 protocol was described in Appendix A of RFC 4306 in 2005. The following issues were addressed:

… excerpt ends here. Continue reading the full article.

Worked examples

Example 1 — a first encounter with Internet Key Exchange

Start with the simplest possible case. Write down what Internet Key Exchange claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Internet Key Exchange before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Internet Key Exchange ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Internet Key Exchange

In research: Internet Key Exchange appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Internet Key Exchange in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Internet Key Exchange is common in secondary-school and first-year university syllabi. It links to neighbouring topics Cryptographic protocols, IPsec, so understanding it makes those chapters shorter.
In everyday life: Look for Internet Key Exchange outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

How to study Internet Key Exchange in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Internet Key Exchange means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Internet Key Exchange out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Internet Key Exchange in simple terms?

In computing, Internet Key Exchange (IKE, versioned as IKEv1 and IKEv2) is the protocol used to set up a security association (SA) in the IPsec protocol suite. IKE builds upon the Oakley protocol and ISAKMP.

Why does Internet Key Exchange matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Internet Key Exchange?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Internet Key Exchange.