Rule 12 of 12 · Chapter III — Running Keys in the Open
Version and negotiate your cryptographic choices so a broken algorithm can be retired without rebuilding the system.
Why this rule exists
Algorithms age in public. The specification being open means attackers read the same cryptanalysis you do, often sooner, and a design that assumes one permanent primitive has to be replaced wholesale when that primitive weakens. A version field costs a byte; a forced rewrite of every client costs a year.
In practice
Tag every ciphertext, token, and handshake with an explicit algorithm or suite identifier, and have receivers dispatch on it from a server-controlled allowlist. Keep the list of accepted suites short and configurable, so retiring one is a configuration change rather than a code change. Test the removal path: disable your current primary suite in staging and confirm clients fall forward, not back.
When it doesn't apply
Negotiation itself is an attack surface — downgrade attacks exist because of it, so never let the attacker choose and never accept a suite you would not have offered. For closed, simultaneously-updated systems with one client and one server, a single version counter is enough; full suite negotiation is overhead you do not need.