Practical Security

Evaluating Crypto Libraries Without Being a Crypto Expert

So now we’ve ruled out low-level crypto libraries. What should we use instead? High-level crypto libraries with secure defaults written by experts.

But how do we know experts when we see them? Evaluating people based on skills we don’t have ourselves is a tough problem with no great solution. We encounter it in other parts of our life. How do we evaluate doctors, mechanics, lawyers, plumbers, and other specialists with skills we don’t have? We tend to use a few techniques. We can look for professionals with certifications. Sometimes we can look for professionals who have written helpful books, articles, or blog posts. We ask our friends or look to the wisdom of crowds and check ratings ...