('kx', 'dh'),
('kx-param', lambda: {'dh': '-LS -b2048 -B256',
'ec': '-Cnist-p256'}[conf['kx']]),
('kx-expire', 'now + 1 year'),
('cipher', 'blowfish-cbc'),
('hash', 'sha256'),
('kx', 'dh'),
('kx-param', lambda: {'dh': '-LS -b2048 -B256',
'ec': '-Cnist-p256'}[conf['kx']]),
('kx-expire', 'now + 1 year'),
('cipher', 'blowfish-cbc'),
('hash', 'sha256'),