IKEv2 was a shitshow because it was designed like a telecoms protocol not because of any NSA conspiracy. Most telecos have control over both ends and want to spend as little on capital expenditures as possible so they put highly-configurable, complicated protocols in place that can be changed on either end.
Turns out that over the internet where your packets are going through middleboxes from different manufacturers that a complicated protocol will be half-implemented everywhere. Wireguard and QUIC both accept the reality that the internet is a "worse is better" system.
An organization like the NSA does not get the benefit of the doubt. Do you know about operation ORCHESTRA?
reply