> > If you're not a cryptographer then you shouldn't be rolling your own crypto.
> How does one become a cryptographer then?
> Yes certainly don't use homerolled crypto in production.
That is the point. When the glib phrase is repeated it is to people who are working on production, or something that might be in danger of one day soon being in production (we've all seen things go from proof of concept to production with insufficient reworking, it happens far too often). In that context it is correct to be constantly restated.
If you are explicitly trying to understand cryptography, then hopefully you are aware of the higher level dangers while you are poking around the lower level details and until you are ready for prime-time you are able to keep your exploratory code from going anywhere near production, at least not without proper scrutiny.
> How does one become a cryptographer then?
> Yes certainly don't use homerolled crypto in production.
That is the point. When the glib phrase is repeated it is to people who are working on production, or something that might be in danger of one day soon being in production (we've all seen things go from proof of concept to production with insufficient reworking, it happens far too often). In that context it is correct to be constantly restated.
If you are explicitly trying to understand cryptography, then hopefully you are aware of the higher level dangers while you are poking around the lower level details and until you are ready for prime-time you are able to keep your exploratory code from going anywhere near production, at least not without proper scrutiny.
It is like the first two rules of optimisation:
Rule 1: Don't.
Rule 2 (for advanced programmers only): Don't yet.