Editing Internet Key Exchange (section)

{{short description|Internet protocol}}
In computing, '''Internet Key Exchange''' ('''IKE''', versioned as '''IKEv1''' and '''IKEv2''') is the protocol used to set up a [[security association]] (SA) in the [[IPsec]] protocol suite. IKE builds upon the [[Oakley protocol]] and [[Internet Security Association and Key Management Protocol|ISAKMP]].<ref name="rfc2409_sec1">The Internet Key Exchange (IKE), RFC 2409, §1 Abstract
</ref> IKE uses [[X.509]] certificates for authentication ‒ either pre-shared or distributed using [[Domain Name System|DNS]] (preferably with [[Domain Name System Security Extensions|DNSSEC]]) ‒ and a [[Diffie–Hellman key exchange]] to set up a [[shared secret|shared session secret]] from which [[Key (cryptography)|cryptographic keys]] are derived.<ref name="rfc3129p1">
{{citation | title= RFC 3129: Requirements for Kerberized Internet Negotiation of Keys | publisher= [[Internet Engineering Task Force]] | url= http://tools.ietf.org/html/rfc3129 | date= June 2001 | page= 1 | doi= 10.17487/RFC3129 | last1= Thomas | first1= M. | doi-access= free }}
</ref><ref name="rfc4322p5">
{{citation | title= RFC 4322: Opportunistic Encryption using the Internet Key Exchange (IKE) | publisher= [[Internet Engineering Task Force]] | url= http://tools.ietf.org/html/rfc4322 | date= June 2001 | page= 5 | doi= 10.17487/RFC4322 | last1= Richardson | first1= M. | last2= Redelmeier | first2= D.H. }}</ref> In addition, a security policy for every peer which will connect must be manually maintained.<ref name="rfc3129p1"/>