[Swan-dev] simplifying default IKEv1 IKE algorithms

[Paul Wouters]

On Mon, 6 Feb 2017, Andrew Cagney wrote:

> look for the defaults?  I left MODP2048 before MODP1532, because,
> based on spdb.c:
>
> - for PSK and/or RSA, it was proposing MODP2048, MODP1536, MODP1024
> - for * XAUTH, it was proposing MODP1536, MODP1024
>
> so we've been proposing 2048 first for some time; we could change this
> of course.

Oh, then leave it I guess.

> For the responder, when no ike=, it defaults to accepting almost
> anything.  That includes MD5, serpent, and twofish (but not cast,
> which is ESP only).

It should not include these three. Md5 is too weak and all md5 users
do sha1. And serpent/twofish are weird ducks and should not be used
unless explicitly configured.

Paul