Which IPsec component negotiates security associations and exchanges keys?

Which IPsec component negotiates security associations and exchanges keys?

• A. Encapsulating Security Payload (ESP)
• B. Authentication Header (AH)
• C. Internet Key Exchange (IKE)
• D. IPsec

Answer: (C)

Negotiating Security Associations and exchanging keys in IPsec is handled by the Internet Key Exchange. IKE establishes the cryptographic parameters that IPsec will use, creating a secure channel between peers and authenticating them in Phase 1. It then negotiates the actual data protections, the Child SAs, in Phase 2, deciding which encryption and authentication algorithms to use and distributing the keys for those protections. ESP and AH are the actual traffic-protection protocols—ESP provides encryption (and optional integrity), while AH provides integrity and authentication without encryption. IPsec is the overall framework that uses ESP, AH, and IKE. So the component responsible for setting up SAs and exchanging keys is IKE.

Negotiating Security Associations and exchanging keys in IPsec is handled by the Internet Key Exchange. IKE establishes the cryptographic parameters that IPsec will use, creating a secure channel between peers and authenticating them in Phase 1. It then negotiates the actual data protections, the Child SAs, in Phase 2, deciding which encryption and authentication algorithms to use and distributing the keys for those protections. ESP and AH are the actual traffic-protection protocols—ESP provides encryption (and optional integrity), while AH provides integrity and authentication without encryption. IPsec is the overall framework that uses ESP, AH, and IKE. So the component responsible for setting up SAs and exchanging keys is IKE.