"Don't roll your own" doesn't mean "never build any crypto". It does affect recommendations for using this library for example. One thing that matters there is

"Don't roll your own" doesn't mean "never build any crypto". It does affect recommendations for using this library for example. One thing that matters there is risk: how much are you losing by not just using existing, extremely similar tools, and how much do you gain from the codebase being smaller? (My professional opinion: balance in favor of libsodium). That changes when the software does things previously impossible or hard. NaCl and libsodium were interesting not because you couldn't do strong and safe AEAD before (OCB is from 2012, AES-CBC + HMAC-SHA256 EtM have been available for almost two decades) -- it's because you finally had a realistic chance of getting random programmers to do AEAD in some code and have it be OK. Noise, hence is interesting because it gives you a transport with interesting new properties, including forward and backward security that you don't get out of the box with NaCl/libsodium. E.g. if you build a naive session protocol with libsodium, odds are you're vulnerable to KCI attacks. That's not a bug in libsodium because it never promised to do that, but it would be a bug in Noise. Similarly: STROBE! New, exciting! Low-footprint crypto! Strong tools! Also not recommending anyone suddenly use STROBE for everything (especially not in software, but we can talk if you have embedded hardware problems).