Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Does the IPSec protocol suite use IKE or ISAKMP?

RFC 2828 states ISAKMP is the protocol used in IPSec to handle SAs, key management and system authentication. Other sources say IKE is the protocol that used.

From RFC 2828:

$ Internet Security Association and Key Management Protocol (ISAKMP)

(I) An Internet IPsec protocol [R2408] to negotiate, establish, modify, and delete security associations, and to exchange key generation and authentication data, independent of the details of any specific key generation technique, key establishment protocol,encryption algorithm, or authentication mechanism.

share|improve this question

5 Answers 5

up vote 9 down vote accepted

Let's clear up some confusion here first. Internet Key Exchange (IKE) is a hybrid protocol, it consists of 3 "protocols"

  • ISAKMP: It's not a key exchange protocol per se, it's a framework on which key exchange protocols operate.

  • Oakley: Describes the "modes" of key exchange (e.g. perfect forward secrecy for keys, identity protection, and authentication)

  • SKEME: Provides support for public-key-based key exchange, key distribution centres, and manual installation, it also outlines methods of secure and fast key refreshment.

So yes, IPSec does use IKE, but ISAKMP is part of IKE.

share|improve this answer

This is an answer from Craig Constatine from network engineering for a similar question:

ISAKMP is part of IKE. (IKE has ISAKMP, SKEME and OAKLEY). IKE establishs the shared security policy and authenticated keys. ISAKMP is the protocol that specifies the mechanics of the key exchange. The confusion, (for me,) is that in the Cisco IOS ISAKMP/IKE are used to refer to the same thing. By which I mean, my understanding is that Cisco's IKE only implements/uses ISAKMP. So one configures IKE, and then conceptually inside that, one configures ISAKMP.

share|improve this answer

IKE is a superset of ISAKMP, Oakley protocol and SKEME.

ISAKMP (protocol to establish a framework for authentication and key exchange)

Oakley (describes a series of key exchanges and services)

SKEME (key exchange technique that provides anonymity, repudiability,and key refreshment).

The RFC you have referred to states that ISAKMP is an IPSEC protocol and it is true.Just that that new devices make use of IKE to setup VPN connnections.

share|improve this answer

Supersetting from microsoft site

I agree with the above, i'm reading on the microsoft site about this and they have ISAKMP encapsulating IKE not ISAKMP, perhaps a mistake from them?

http://technet.microsoft.com/en-us/library/cc759130(v=ws.10).aspx

share|improve this answer

ISAKMP can be viewed as the conception framework and IKE as the concrete realization of ISAKMP. The actual implementation of IKE then uses both Oakley and SKEME to achieve its goals (all implementation but cisco one, as it doesn't use nor Oakley nor SKEME, then the confusion with ISAKMP in the cisco world, correct me if I'm wrong). in the development world, one can think of ISAKMP as a abstract class (C++) or as an interface (Java), and IKE as the concrete class that implements this abstract class or interface ...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.