> you seem to be responding to an argument that wasn't made. I seem to be, but I'm not. > I think there's a more fundamental cryptographic principle. Don't im

> you seem to be responding to an argument that wasn't made. I seem to be, but I'm not. > I think there's a more fundamental cryptographic principle. Don't implement cryptography, unless you are an absolute top expert. Even then, think twice, and get another absolute top cryptography expert to check your working. Use a pre-existing cryptography package that has been written properly instead. This is written towards ALL developers. In the scope of web developers that I reside, this is my rebuttal. Some crypto experts are quick to demand people use something that isn't necessarily available to the developer. Then the language elitists tell them to switch to their preferred language instead of improving what the developers already know. End result? People just use insecure or badly designed crypto libraries. We need better libraries. Someone has to write them. Or just make libsodium the standard. I'd be okay with that.