Which component of IPsec performs protocol-level functions that are required to encrypt and decrypt the packets?

IKE (Internet Key Exchange) negotiates and manages the cryptographic keys and security associations, but does not perform packet-level encryption or decryption.

Oakley is a key determination protocol that defines the framework for key exchange; it does not handle packet encryption or decryption directly.

The IPsec Policy Agent retrieves and manages IPsec policy from Active Directory or local storage and passes it to the driver, but does not perform cryptographic operations itself.

The IPsec driver operates at the network stack level and performs the real-time, packet-by-packet cryptographic operations - encrypting outbound packets and decrypting inbound packets - using the keys and algorithms negotiated by IKE. It intercepts IP traffic and applies the transforms specified in the Security Association (SA), making it the component that directly handles encrypt/decrypt functions. Without the driver, no actual data protection would occur even if policies and keys are in place.