<story><title>Ruining the Magic of Magento&apos;s Encryption Library</title><url>http://www.openwall.com/lists/oss-security/2016/07/19/3</url></story><parent_chain></parent_chain><comment><author>qwertyuiop924</author><text>Look, I don&amp;#x27;t care if you use PHP. But if you aren&amp;#x27;t an expert, and your code hasn&amp;#x27;t been audited by experts, don&amp;#x27;t write your own crypto. Use libsodium, or libressl&amp;#x27;s libcrypto (if you think openssl is a good bet, you really need to see the talk that discusses the reasons for that fork), or libgcrypt. But for crying out loud, use a library that is actively used and vetted by people who KNOW WHAT THEY&amp;#x27;RE TALKING ABOUT. And do your best to know what you&amp;#x27;re talking about, too.</text></comment>
<story><title>Ruining the Magic of Magento&apos;s Encryption Library</title><url>http://www.openwall.com/lists/oss-security/2016/07/19/3</url></story><parent_chain></parent_chain><comment><author>api</author><text>I&amp;#x27;m not going to say don&amp;#x27;t write crypto. Instead I will give more useful advice: if you do write crypto, make it boring. Really boring. Do not invent anything. Do not be creative. Use an established modern construction with modern ciphers and use them in only one way. That one way should be the way cryptographers recommend with no deviations.</text></comment>