  <varlistentry>
  <term><emphasis remap='B'>ike</emphasis></term>
  <listitem>
<para>IKE encryption/authentication algorithm to be used
for the connection (phase 1 aka ISAKMP SA).  The format is
<emphasis remap='I'>"cipher-hash;modpgroup, cipher-hash;modpgroup, ..."</emphasis>
Any left out option will be filled in with all allowed default
options. Multiple proposals are separated by a comma. If an
<emphasis remap='B'>ike=</emphasis>
line is specified, no other received proposals will be accepted.
Formerly there was a distinction (by using a <emphasis remap='B'>"!"</emphasis> symbol) between
"strict mode" or not. That mode has been obsoleted. If an <emphasis remap='B'>ike=</emphasis> option is
specified, the mode is always strict, meaning no other received proposals will be accepted.
Some examples are
<emphasis remap='B'>ike=3des-sha1,aes-sha1</emphasis>,
<emphasis remap='B'>ike=aes</emphasis>,
<emphasis remap='B'>ike=aes128-md5;modp2048</emphasis>,
<emphasis remap='B'>ike=aes128-sha1;dh22</emphasis>,
<emphasis remap='B'>ike=3des-md5;modp1024,aes-sha1;modp1536</emphasis> or
<emphasis remap='B'>ike=modp1536</emphasis>.
The options must be suitable as a value of
<citerefentry><refentrytitle>ipsec_spi</refentrytitle><manvolnum>8</manvolnum></citerefentry>'s
<option>--ike</option> option. The default is to use IKE, and to allow all combinations of:
<literallayout remap='.nf'><emphasis remap='B'>
                cipher:                 3des or aes
                hash:                   sha1 or md5
                pfsgroup (DHgroup):     modp1024 or modp1536
</emphasis></literallayout></para>
<para>
Weak algorithms are regularly removed from libreswan. Currently, 1DES and modp768 have been removed and modp1024
will be removed in the near future. Additionally, md5 and sha1 will be removed within the next few years. Null
encryption is available, and should only be used for testing or benchmarking purposes. Please do not request for
insecure algorithms to be re-added to libreswan.
</para>
<para>Diffie-Hellman groups 22, 23 and 24 are also implemented as per RFC-5114. Instead of the modp
key syntax, use the "dh" keyword, for example <emphasis>ike=3des-sha1;dh23</emphasis>
</para>
<para>The modp syntax will be removed in favour of the dh syntax.</para>
  </listitem>
  </varlistentry>

