IKE uses a Diffie-Hellman key exchange to set up a shared session secret , from which cryptographic keys are derived . IKE uses X. 509 certificates for authentication which are either pre-shared or distributed using DNS ( preferably with DNSSEC ) , and a Diffieâ `` Hellman key exchange to set up a shared session secret from which cryptographic keys are derived .