Yep. I think we can go farther than that and say that it's been historically screwed up by protocol designers and/or implementers more often than not (with pred

Yep. I think we can go farther than that and say that it's been historically screwed up by protocol designers and/or implementers more often than not (with predictable IVs, timing and length oracles, MAC-then-encrypt, etc)