Implementing internet key exchange (IKE)

Abstract

A key component of the IP Security architecture is the Internet Key Exchange protocol. IKE is invoked to establish session keys (and associated crypto-graphic and networking conguration) between two hosts across the network. IKE needs to authenticate and authorize the parties involved in an exchange, negotiate parameters to be used for the communi-cation, and interact with the local IPsec stack. The number of tasks, along with the \nexibility built into the protocol, as well as the need to allow future ad-ditions and modications to the protocol, need to be taken into consideration when designing and im-plementing IKE. Another complicating factor is the need for security policy management. Although IKE can establish se-curity associations with remote hosts, some method for determining what kinds of traÆc can and should be exchanged with a remote host is necessary. As there is no standard specication yet, we are us-ing a trust-management based approach using the KeyNote system as a basis for specifying policy. This paper discusses the design, architecture, and implementation details of the OpenBSD IKE dae-mon, with separate mention of the security policy mechanism.