If there would forever be only one encryption algorithm in use we we wouldn't need most of the stuff.
If there would forever be only one encryption algorithm in use we we wouldn't need most of the stuff.
Coincidentally, this is why a protocol like WireGuard is much simpler than OpenVPN. It's a clean-sheet design, so its developers had the luxury to design it with hardcoded modern crypto primitives without any revision or extension. Protocol negotiation is skipped entirely since it's often error-prone and suspect to attacks...
I think it's basically the plan.
Even with protocol negotiation, replacing an existing crypto algorithm would be a breaking change anyway. Furthermore, it should be possible to preserve backward compatibility using a reserved field without a heavy-weight, full-fledged protocol negotiation. Entering a different code path if the message is tagged "version 2" should be enough.