> BTW, I see no difference in version negotiation and primitive negotiation. You can't say "primitive negotiation is bad!" and "protocol negotiation is not bad!

> BTW, I see no difference in version negotiation and primitive negotiation. You can't say "primitive negotiation is bad!" and "protocol negotiation is not bad!". Especially since negotiating protocol versions without crypto primitives is just screaming for downgrade attacks. Primitive negotiation involves primitives being decided at runtime. This means you can, for example, tell a system that normally does RSA verification to switch to HMAC-SHA256 instead (but using the RSA public key as a HMAC shared key). This is what bit many JWT implementations. Protocol negotiation involves primitives being decided at the time that a protocol version is defined, and then you can only select the version to use. You don't get to tell the server "use this encryption algorithm in this mode", you can only say "use v2" or "use v3". There is no mix-n-match potential. You can't use v2 age with RSA. This isn't a subtle difference. Most cryptography vulnerabilities occur at the joinery between primitives. See also: https://paragonie.com/blog/2019/10/against-agility-in-cryptography-protocols https://paragonie.com/blog/2019/10/against-agility-in-crypto...