[Swan-dev] simplifying default IKEv1 IKE algorithms

[Paul Wouters]

On Fri, 3 Feb 2017, Andrew Cagney wrote:

> Should the second table be dropped and just the first used, that is:
>
>   - the only way to get modp1024 is to specify it explicitly
>   - sha2 appears in all defaults and is preferred to sha1 and md5

Yes, but!

I think for IKEv1 as initiator, we should prob do modp1536 and not use
sha2, because we are dealing with lots of old devices that dont support
or have configured modp2048 and sha2. And a lot of old ikev1 code (eg
openswan) does not properly do INVALID_KE and re-send with the
downgraded modp group.

But as responder, there is no reason why not to accept the better
values.

Paul