Which component of IPsec performs protocol-level functions that are required to encrypt and decrypt the packets?

IKE is responsible for negotiating and establishing security associations and exchanging cryptographic keys, not for encrypting or decrypting data packets.

Oakley is a key exchange protocol used within the IKE negotiation process and does not perform packet-level cryptographic operations.

The IPsec Policy Agent retrieves and applies IPsec policy settings from the policy store but does not perform encryption or decryption on packets.

The IPsec driver operates at the network stack level, intercepting both inbound and outbound IP packets and applying the cryptographic transforms (such as AES or 3DES) specified by the active security associations. It performs the actual protocol-level work of encapsulating, encrypting, decrypting, and authenticating packets, distinct from management components that only configure policy.