IKE

Two machines want to use IPsec. But before encrypting anything they need to agree on things like: * cryptographic algorithms, * keys, * identities, * security parameters. How do they establish all of this securely?

Internet Key Exchange lets the peers authenticate and negotiate the cryptographic material and security associations IPsec will use. To establish a shared secret while keeping it off the network, IKE uses a Diffie–Hellman key exchange: each peer sends a public value and keeps its private value secret. Each combines its private value with the other's public value to calculate the same shared secret locally, then derives IPsec keys from it.