No, it's not just crypto primitives, it's crypto protocols, too. It's even designing other protocols that run on top of crypto protocols (see CRIME). Even imp

No, it's not just crypto primitives, it's crypto protocols, too. It's even designing other protocols that run on top of crypto protocols (see CRIME). Even implementing existing crypto primitives is hazardous: D.J. Bernstein's work on cache timing attacks against AES are proof of that. The problem with crypto is that it's a specialist profession that generalists think they can do. In reality, crypto is more like law than software engineering: You can't just reason it from first principles, and you can't write any tests that will tell you that it's working. You have to know the specific attacks that people are capable of, and come up with a strategy that will avoid not only the current attacks that you know about, but future attacks that haven't been discovered yet. You're tasked with building a system of obstacles that nobody will be able to find any clever workarounds for, and your adversaries are smarter than you, more numerous than you, more well-funded than you, they're experts in breaking crypto, and they're all from the future. That's not something a handful of engineers working in isolation can do. It takes the whole community years to even come close. Saying that software engineers can design crypto protocols is like saying that software engineers can be their own lawyers. A few can, but almost all engineers who think they know the law are wrong. Even lawyers routinely lose cases. The best we can do is to try to give them better tools to handle the common cases (e.g. Creative Commons, SSH, better APIs), and remind them to talk to the specialists before getting too creative.