This article is correct. However, it is important to call-out something that is far too prevalent, much code incorrectly uses correct crypto primitives. The w

This article is correct. However, it is important to call-out something that is far too prevalent, much code incorrectly uses correct crypto primitives. The world is full of calls to CBC with improper IVs, for one simple example. Another spot-on example mentioned in the article is timing oracles. Security coding in general, not just crypto, uses an entirely different set of principles from functional programming. It is for this reason that "security" cannot be bolted-on, and cryptography cannot just be "dropped into" the code.