A secure and versatile key exchange protocol for key management over
Internet is presented.  SKEME constitutes a compact protocol that
supports a variety of realistic scenarios and security models over
Internet.  It provides clear tradeoffs between security and performance
as required by the different scenarios without incurring in unnecessary
system complexity.  The protocol supports key exchange based on public
key, key distribution centers, or manual installation, and provides for
fast and secure key refreshment.  In addition, SKEME selectively
provides perfect forward secrecy, allows for replaceability and
negotiation of the underlying cryptographic primitives, and addresses
privacy issues as anonymity and repudiatability.