Negotiation of Diffie-Hellman algorithm must be started already in the
I1 message to avoid overly large R1 packets filled with different D-H
parameters. This introduces the possibility for a man-in-the-middle
attack where the attacker mounts a downgrade attack on the Initiator and
Responder. The attacker can alter the I1 because it is unprotected. Thus,
the attacker can cause the Responder to offer unnecessarily too weak
algorithms or key lengths in R1 and.
For some reason, I read that "and." and am looking for some more text...