The thing is, I'm not rolling my own here (minus message authentication, but based on cursory reading, this is how it's done anyways). I'm using standard OpenSS

The thing is, I'm not rolling my own here (minus message authentication, but based on cursory reading, this is how it's done anyways). I'm using standard OpenSSL libraries - things that are vetted, and I'm using like they suggest. Rolling my own was using it without an IV and without message authentication (aka getting it half right). I'm not doing that any more. Obviously the libraries he suggested are different than the ones I'm using, but that in itself shouldn't be a case for dismissal. The ones I'm using are industry standard. His suggestion uses a different stream cipher and a different key generation scheme, the ciphers and key generation scheme I'm using are what are behind SSL/TLS - something which is not broken. The NSA didn't break this, they bought their way through the crypto, which should tell you something about its strength. I am generally curious though, to make sure I got what I did right. I think I have - and again the only part I'm not sure about entirely is message authentication. Some places online suggest including the IV in with the authentication. However, since the code is open to the public, and if an attacker were to take my database, they'd have the IV no problem. The only thing they wouldn't have is what I'm signing each message with, the thing that really does the authentication, my server config variable only used for message auth.