RFC 2409 (rfc2409) - Page 2 of 41
The Internet Key Exchange (IKE)
Alternative Format: Original Text Document
RFC 2409 IKE November 1998 10 Security Considerations........................................ 28 11 IANA Considerations............................................ 30 12 Acknowledgments................................................ 31 13 References..................................................... 31 Appendix A........................................................ 33 Appendix B........................................................ 37 Authors' Addresses................................................ 40 Authors' Note..................................................... 40 Full Copyright Statement.......................................... 41 1. Abstract ISAKMP ([MSST98]) provides a framework for authentication and key exchange but does not define them. ISAKMP is designed to be key exchange independant; that is, it is designed to support many different key exchanges. Oakley ([Orm96]) describes a series of key exchanges-- called "modes"-- and details the services provided by each (e.g. perfect forward secrecy for keys, identity protection, and authentication). SKEME ([SKEME]) describes a versatile key exchange technique which provides anonymity, repudiability, and quick key refreshment. This document describes a protocol using part of Oakley and part of SKEME in conjunction with ISAKMP to obtain authenticated keying material for use with ISAKMP, and for other security associations such as AH and ESP for the IETF IPsec DOI. 2. Discussion This memo describes a hybrid protocol. The purpose is to negotiate, and provide authenticated keying material for, security associations in a protected manner. Processes which implement this memo can be used for negotiating virtual private networks (VPNs) and also for providing a remote user from a remote site (whose IP address need not be known beforehand) access to a secure host or network. Client negotiation is supported. Client mode is where the negotiating parties are not the endpoints for which security association negotiation is taking place. When used in client mode, the identities of the end parties remain hidden. Harkins & Carrel Standards Track
