Not much to add here myself other than something for the folks who are less steeped in networking and security concerns: you should not try to audit this stuff

Not much to add here myself other than something for the folks who are less steeped in networking and security concerns: you should not try to audit this stuff yourself. Parent to this post can help you find a good auditor for your language. It's very tempting, especially for smart, multilingual, incredibly talented individuals to just roll this as if the libraries below you don't matter. Crypto is, unfortunately, the leakiest of the leaky abstractions you can end up building on. No matter what, I always have someone else (and preferably several someone elses) check my work when it comes to authentication systems and encryption. IANAL,EIIWTWNBFLA,UHTPMTGMROOTS. tpateck is a much better person to talk to than me if you need to find someone to help you deal with these issues most subtle.