<varlistentry>
  <term>
    <emphasis remap='B'>ah</emphasis>
  </term>
  <listitem>
    <para>
      A comma separated list of AH algorithms that will be
      offered/accepted when negotiating the Child SA.  The general
      syntax is:
      <programlisting>
	AH = PROPOSAL[,PROPOSAL...]
	PROPOSAL = INTEG_ALGS[-DH_ALGS]
	INTEG_ALGS = INTEG_ALG[+INTEG_ALG...]
	DH_ALGS = DH_ALG[+DH_ALG...]
      </programlisting>
      During startup,
      <citerefentry>
	<refentrytitle>ipsec_pluto</refentrytitle>
	<manvolnum>8</manvolnum>
      </citerefentry>
      will log all supported AH algorithms.
    </para>
    <para>
      Specifying the DH algorithms explicitly is
      <emphasis>not</emphasis> recommended.  When PFS is enabled, and
      the DH algorithms are omitted, each PROPOSAL will automatically
      include the DH algorithm negotiated during the IKE exchange.
    </para>
    <para>
      The default is not to use AH. If for some (invalid) reason you
      still think you need AH, please use esp with the null encryption
      cipher instead.
    </para>
    <para>
      For instance:
      <programlisting>
	ah=sha2_256+sha2_512
	ah=sha2_256+sha2_512-dh14+dh19
      </programlisting>
      If not specified, a secure set of defaults will be used.  The
      program:
      <programlisting>
	ipsec algparse ah=...
      </programlisting>
      can be used to query these defaults.
    </para>
  </listitem>
</varlistentry>
