> There is no such rule in general. Actually, the general rule is, "Do not roll your own crypto." > It depends on your attack model and what you are trying to

> There is no such rule in general. Actually, the general rule is, "Do not roll your own crypto." > It depends on your attack model and what you are trying to achieve. It depends on so much more than those two items, which is why people are told, "don't roll your own crypto." There is almost a 1to1 relationship between looking at homemade crypto and finding severe vulnerabilities such as oracles, input reuse, incorrect encryption modes for the purpose of use, use of broken crypto, and a million other gotchas that most people don't know they need to know.