The systems communicating via IPSec use keys to decipher data that has been encrypted using algorithms. The key can be generated using algorithms on the systems communicating so that the key does not have to travel across the network.
Key lengths can be varied depending on how secure the data needs to be.
Keys can also be dynamically changed during a session in case a key is captured and deciphered then the rest of the data will be encrypted using a different key. IPSec can be forced on users by using policies. IPSec communication can be assigned on a group to group basis.