When dealing with IPSec based VPNs, I understand that there is a slight "problem" with symmetric key exchange. Obviously, you can't send the keys over the VPN, since they are used to guarantee the confidentiality of the information also sent over the VPN. So you have to use some sort of alternative route.

Now, I know that IPSec contains a process for this, IKE. But, would IKE work within a VPN? I found an interesting article on this, but right when it gets to a point where my current question would be answered, it seems to abruptly back off and leave me assuming that some common algorithms like DES, AES, Blowfish, RC4, etc., are used, and the encrypted keys are just sent in the clear.

Here is this article: http://csrc.nist.gov/publications/nistpubs/800-77/sp800-77.pdf (section 2.2)

So, when it comes to symmetric key transfer on a VPN that uses IPSec, how are the keys sent?


4 Answers 4


If you check out the IKE wikipedia page it describes how the symmetric keys are established. IKE consists of two phases. Phase one negotiates the IKE-SA which establishes a secure channel to transmit the key. The key is used to encrypt further communications. Phase 2 establishes the IPSec-SAs which contain the algorithms and keys etc that are used for the traffic that is to be secured by IPSec. The wiki page states that it IKE uses a Diffie-Hellman key exchange to create the shared secret that is used to derive the keys. Hope this helps some.

  • I'm familiar with IKE, but is IKE affected by being used in a VPN? Nov 4, 2012 at 19:43
  • can you clarify what you mean by "is IKE affected by being used in a VPN?"
    – dudebrobro
    Nov 5, 2012 at 0:19

For symmetric encryption the key is usually pre-shared and doesn't get transferred over the network because that would render the connection even more insecure. Also, how to transfer the key required to set up a secure connection over an insecure network before having established this connection? That's impossible.

And the IKE protocol is always used when establishing new connections or keeping existing ones alive, so there must be some misunderstanding at your side about the actual IPsec work flow.


IKE is a protocol for establishing a session key between two machines. The machines negotiate the algorithm for doing that key agreement. There are two types of algorithms for that:

  • With a pre-shared key: the two machines already share a common secret value, and expand on that. How that original secret went to be shared is "out of scope". Last time I configured IPsec with a pre-shared key, I had manually transferred that key within a SSH session.

  • With the magic of asymmetric cryptography. This one does not need a shared secret; but some root public keys must be agreed upon. With IKE, this usually relies on X.509 certificates.

Since a VPN is a system for transferring IP packets (within a layer of protection), it should be compatible with anything which runs over IP packets, including IKE. However, things are usually done in the reverse order: IPsec is a VPN; so, if you already have a VPN, why would you meddle with IPsec at all ?


i believe that the actual keys are exchanges during messages 3 and 4 of phase 1. IPSEC uses diffie helman key exchange mechanism to exchange the keys.As far as the pre shared key is concerned, it is used during messages 5 and 6 and that is for identity establishment, not for encryption.The identity details are encrypted using the symmetric key obtained after messages 3 and 4 in phase 1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.