Does IPSec use IKE or ISAKMP?

Question

Does the IPSec protocol suite use IKE or ISAKMP?

RFC 2828 states ISAKMP is the protocol used in IPSec to handle SAs, key management and system authentication. Other sources say IKE is the protocol that used.

From RFC 2828:

$ Internet Security Association and Key Management Protocol (ISAKMP)

(I) An Internet IPsec protocol [R2408] to negotiate, establish, modify, and delete security associations, and to exchange key generation and authentication data, independent of the details of any specific key generation technique, key establishment protocol,encryption algorithm, or authentication mechanism.

Answer 1

Let's clear up some confusion here first. Internet Key Exchange (IKE) is a hybrid protocol, it consists of 3 "protocols"

• ISAKMP: It's not a key exchange protocol per se, it's a framework on which key exchange protocols operate.

• Oakley: Describes the "modes" of key exchange (e.g. perfect forward secrecy for keys, identity protection, and authentication)

• SKEME: Provides support for public-key-based key exchange, key distribution centres, and manual installation, it also outlines methods of secure and fast key refreshment.

So yes, IPSec does use IKE, but ISAKMP is part of IKE.

Answer 2

This is an answer from Craig Constatine from network engineering for a similar question:

ISAKMP is part of IKE. (IKE has ISAKMP, SKEME and OAKLEY). IKE establishs the shared security policy and authenticated keys. ISAKMP is the protocol that specifies the mechanics of the key exchange. The confusion, (for me,) is that in the Cisco IOS ISAKMP/IKE are used to refer to the same thing. By which I mean, my understanding is that Cisco's IKE only implements/uses ISAKMP. So one configures IKE, and then conceptually inside that, one configures ISAKMP.

Answer 3

ISAKMP can be viewed as the conception framework and IKE as the concrete realization of ISAKMP. The actual implementation of IKE then uses both Oakley and SKEME to achieve its goals (all implementation but the Cisco one, as it neither uses Oakley nor SKEME, resulting in the confusion with ISAKMP in the Cisco world; correct me if I'm wrong). in the development world, one can think of ISAKMP as a abstract class (C++) or as an interface (Java), and IKE as the concrete class that implements this abstract class or interface ...

Answer 4

IKE is a superset of ISAKMP, Oakley protocol and SKEME.

ISAKMP (protocol to establish a framework for authentication and key exchange)

Oakley (describes a series of key exchanges and services)

SKEME (key exchange technique that provides anonymity, repudiability,and key refreshment).

The RFC you have referred to states that ISAKMP is an IPSEC protocol and it is true.Just that that new devices make use of IKE to setup VPN connnections.

Answer 5

I agree with the above, i'm reading on the microsoft site about this and they have ISAKMP encapsulating IKE not ISAKMP, perhaps a mistake from them?

http://technet.microsoft.com/en-us/library/cc759130(v=ws.10).aspx