[tptacek]

Just like with TLS and its "ciphersuites", you expose the vulnerable components for as long as (1) you're required to by your users and (2) the risk is bearable. At some point, you stop exposing the vulnerable component at all. Ciphersuite negotiation doesn't free you from this requirement, but it does make it harder to ensure that peers who agree on non-vulnerable parameters are actually able to use them.

None of this is complicated. It's also worth looking back on the history of TLS vulnerabilities to get a sense of just how little ciphersuite negotiation helped anybody.

[upofadown]

My understanding is that Wireguard has no way to do anything other than what it does now. There is no way to use an upgrade in the protocol.

[tptacek]

The same was true of TLS!

[wglb]

And that is a good thing.