I agree that modern cryptography isn't usually broken through design cryptanalysis, but I wouldn't bucket all the ways it usually fails into key management. The

I agree that modern cryptography isn't usually broken through design cryptanalysis, but I wouldn't bucket all the ways it usually fails into key management. There is a lot of misuse and misimplementation which goes beyond weak keys and key reuse. I would rather say modern cryptography typically fails in one of three ways: 1. Incorrect implementation of low level primitives. For example: implementing textbook RSA (without padding). 2. Improper composition of correct primitives. For example: implementing an authenticated encryption construction using CBC mode with a MAC that shares its key with the CBC secret key, or simply using key = IV. 3. Incorrect usage of correct primitives. For example: nonce reuse with the same key, using regular cryptographic hash functions for password hashing, using an HMAC key larger than the block size, or using unauthenticated encryption to prevent tampering (e.g. URL parameters).