> In particular: the whole protocol is versioned, rather than serving as a metaprotocol that negotiates the underlying cryptography. In my view, that's one of

> In particular: the whole protocol is versioned, rather than serving as a metaprotocol that negotiates the underlying cryptography. In my view, that's one of the big takeaways from early cryptographic protocols: complex handshake negotiations just won't be secure, so just don't. The other is that crypto code should ideally not contain any parsing at all. e: Well that and the whole debacle on the level of primitives and operation modes of course.