In secure IP multicast, which protocol handles group key management?

IPsec is the security framework providing data-plane encryption and integrity protection, but it does not define the group key distribution mechanism needed for multicast environments.

GDOI (Group Domain of Interpretation), defined in RFC 3547, is specifically designed to handle group key management for secure multicast environments such as Cisco GET VPN. It uses a Key Server (KS) to generate and distribute the Traffic Encryption Key (TEK) and Key Encryption Key (KEK) to Group Members (GM), enabling all members to share a common security association and decrypt multicast traffic without the need for per-peer IKE negotiations.

MD5 is a cryptographic hash algorithm used for data integrity verification, not a protocol for managing or distributing encryption keys to multicast group members.

SHA-256 is a cryptographic hash function used for integrity and digital signatures, not a key management or key distribution protocol for multicast groups.