You realise experts at cryptography, even implementation, are fallible right? Case in point: https://www.daemonology.net/blog/2011-01-18-tarsnap-critical-secur

You realise experts at cryptography, even implementation, are fallible right? Case in point: https://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html https://www.daemonology.net/blog/2011-01-18-tarsnap-critical... Not saying the same situation either; obviously Colin made a silly mistake while refactoring. We don't actually know the issue with these implementors, but again I ask, with having actual professionals in the field, what should they have done instead of rolling their own for a primitive that doesn't exist in the language?