Thanks for sharing the slides (and techpeace for the links to the video). A question I have though is given that we (those of us who collectively don't identif

Thanks for sharing the slides (and techpeace for the links to the video). A question I have though is given that we (those of us who collectively don't identify ourselves as security rocket-surgeons) are always advised to stick with the high-level stuff and to stay away from stuff like AES (ref. slide 16), which nobody does anyway, then why is no mention ever made of established and known protocols? Examples like - Needham-Schroeder (fixed version), http://en.wikipedia.org/wiki/Needham-Schroeder_protocol http://en.wikipedia.org/wiki/Needham-Schroeder_protocol - Otway-Rees, http://en.wikipedia.org/wiki/Otway%E2%80%93Rees_protocol http://en.wikipedia.org/wiki/Otway%E2%80%93Rees_protocol have proven to be really useful. Yes, there's a metric ton of work involved in implementing something like this, but going through it once is amazing practice for getting it right in future (that, at least, is my experience). Why is it that we talk about symmetric and asymmetric encryption, but never go as far as the protocols that provide real context for their uses?