text: IKE uses X. 509 certificates for authentication which are either pre-shared or distributed using DNS ( preferably with DNSSEC ) , and a Diffieâ `` Hellman key exchange to set up a shared session secret from which cryptographic keys are derived .
simplified: IKE uses a Diffie-Hellman key exchange to set up a shared session secret , from which cryptographic keys are derived .