It's definitely easier to look for known flaws, such as obvious spec violations like this ECDSA signing flaw. It's much harder to review a high-assurance system

It's definitely easier to look for known flaws, such as obvious spec violations like this ECDSA signing flaw. It's much harder to review a high-assurance system and be sure you've anticipated all possible ways something might fail years down the road. One point I have not said recently is that crypto review is very expensive in terms of time and money. So the design approach to security problems should be roughly: 1. Avoid crypto if possible. Store data on the server, for example. Doing this correctly is orders of magnitude easier than developing crypto protocols. 2. If using crypto, use something high-level. GPG is a great example of a bundle of crypto primitives with a well-understood protocol for encryption, integrity protection, and key management. PGP has been around for 20 years now. 3. If none of the above works, develop custom crypto protocol. But budget 10x for review as for design/implementation. So if you spend a week and $10,000 developing it, spend 10 weeks and $100,000 to review/improve it. This includes external review, not just internal. This goes for everyone, even "experts". My main point is: "Crypto costs a lot. Are you sure you want to pay for it?" Because if you do implement custom crypto, you (or your users) will pay for it one way or another.