IPSec Overview Part Four: Internet Key Exchange (IKE)
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
IKE Overview
Internet Key Exchange (IKE) negotiates the IPSec security associations (SAs). This process requires that the IPSec systems first authenticate themselves to each other and establish ISAKMP (IKE) shared keys.
NOTE
A security association (SA) is a relationship between two or more entities that describes how the entities will use security services to communicate securely.
In phase 1 of this process, IKE creates an authenticated, secure channel between the two IKE peers, called the IKE security association. The Diffie-Hellman key agreement is always performed in this phase.
In phase 2, IKE negotiates the IPSec security associations and generates the required key material for IPSec. The sender offers one or more transform sets that are used to specify an allowed combination of transforms with their respective settings. The sender also indicates the data flow to which the transform set is to be applied. The sender must offer at least one transform set. The receiver then sends back a single transform set, which indicates the mutually agreed-upon transforms and algorithms for this particular IPSec session. A new Diffie-Hellman agreement may be done in phase 2, or the keys may be derived from the phase 1 shared secret.
Figure 1 shows the role that IKE takes in the IPSec VPN creation process.
){kind=link}
Figure 1 The function of IKE.
IKE authenticates the peer and the IKE messages between the peers during IKE phase 1. Phase 1 consists of main mode or aggressive mode. (These modes are described later in this article.) Potential peers in an IPSec session must authenticate themselves to each other before IKE can proceed. Peer authentication occurs during the main mode exchange during IKE phase 1. The IKE protocol is very flexible and supports multiple authentication methods as part of the phase 1 exchange. The two entities must agree on a common authentication protocol through a negotiation process.
IKE phase 1 has three methods to authenticate IPSec peers in Cisco products:
Pre-shared keys. A key value entered into each peer manually (out of band) and used to authenticate the peer.
RSA signatures. Uses a digital certificate authenticated by an RSA signature.
RSA encrypted nonces. Uses RSA encryption to encrypt a nonce value (a random number generated by the peer) and other values.
A common value used by all authentication methods is the peer identity (ID), which helps identify the peer. Some ID values used are as follows:
IP address of the peer (four octets), such as 172.30.2.2.
Fully qualified domain name (FQDN), such as student@cisco.com.