Original: IKE uses X. 509 certificates for authentication which are either pre-shared or distributed using DNS ( preferably with DNSSEC ) , and a Diffieâ '' Hellman key exchange to set up a shared session secret from which cryptographic keys are derived .
Simplified: IKE uses a Diffie-Hellman key exchange to set up a shared session secret , from which cryptographic keys are derived .