It is bothersomely true that every major cryptosystem in the last five years or so has had serious protocol or implementation errors -- IPSec's early incarnations, SSL2(which we're still not rid of), SSL3/TLS (with the still troublesome lack of PFS), SSH (with various remote roots in the common daemons), etc.

It's problematic.

--Dan