To pick on the memory-safe languages bit: - I get it. But libcrypto is less likely to have some insane UAF bug than, say, libtiff or whatever. If you're going

To pick on the memory-safe languages bit: - I get it. But libcrypto is less likely to have some insane UAF bug than, say, libtiff or whatever. If you're going to use unsafe code, libcrypto and libsodium are pretty great choices. I wrote a Clojure (so JVM) library that binds libsodium FWIW. - I hear nice things about Rust's ring lib. Still gotta FFI from OCaml or the JVM though. - A lot of the recommendations on this list are algorithms designed to be safe to implement. For example, it's unlikely that a JVM impl of XSalsa20 + Poly1305 is suddenly unsafe because of the environment you're running in. This is NOT TRUE for things like AES-GCM; firstly a lot of naive AES implementations are insecure, and good luck doing GHASH safely in software.