if you design a protocol to somehow have "upgradable" hashes, clients still need to be patched to support them, and old clients still will not work. Its the sam

if you design a protocol to somehow have "upgradable" hashes, clients still need to be patched to support them, and old clients still will not work. Its the same mistake TLS and IPSEC made, supposedly extensible, but not really because to actually get new features, clients all need to be upgraded, and old incompatible clients still exist, and will never work with whatever new features you want to employ. You aren't really gaining anything, and you might as well just have new versions of the protocol, and save all the pointless ceremony, complexity and security holes. There is no way (beyond maybe embedding some kind of executable code in the protocol itself, which seems like an insane idea) to have support from "day one" for algorithms and functionality that don't even exist yet.