Windows 10 IKEv2 Phase 2 (IPsec) proposals

Windows 10 (2019) has a very limited proposal list for Phase 2:

Change defaults in the registry

It is possibly to registry-patch Windows to use stronger crypto See e.g. the “NegotiateDH2048_AES256” registry value

Change the settings of a single tunnel via PowerShell “Set-VpnConnectionIPsecConfiguration”

https://docs.microsoft.com/en-us/powershell/module/vpnclient/set-vpnconnectionipsecconfiguration?view=win10-ps

GUI lets you improve the default ciphers and HMACs, but not DH Groups

Footnotes

• Diffie-Hellman group 2 (1024 bit) is no longer considered secure against state-level actors or equivalent. See LogJam.
• SHA1 is known to be flawed, but is still fine for use as an HMAC, as the flaws are mitigated by the HMAC construct. Additionally, there is simply no time to mount an attack from one packet to the next

Related articles