This is why complexity is so terribly evil in secure protocols. All these features, feature flags, upgrades, downgrades, state transitions... it's all surface a

This is why complexity is so terribly evil in secure protocols. All these features, feature flags, upgrades, downgrades, state transitions... it's all surface area for bugs. A complete state diagram for a modern SSL/TLS stack would be huge and contains edge cases that are probably undocumented and poorly understood. Do boring crypto: https://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf https://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf Boring crypto means minimal state, minimal code (and therefore easy to audit), a minimal set of algorithms with new algorithms and encodings and such being added only when absolutely necessary, etc. Crypto "flexibility" means edge case bugs and lots of code where bugs can hide. There is in general an exponential relationship between LOC and complexity and bugs. In crypto and security code this is really bad.