This reports the encryption algorithm used in the Phase-1 negotiation for this specific control tunnel, per its description - the live, per-tunnel record of exactly which cipher is actually protecting this tunnel's ISAKMP messages, as opposed to what a policy merely specifies. It matters for spot-checking that a tunnel is actually using the strong algorithm an admin intended, since negotiation could theoretically fall back to a weaker mutually-supported option if policies aren't perfectly aligned between peers. A tunnel unexpectedly showing 'des' when every configured policy on this device specifies AES would reveal that this peer negotiated down to an older, weaker fallback.