[dsacco]

13 days (let's call it two weeks, assuming full person/weeks of time) is not atypical for an assessment. If you have multiple people working simultaneously on a two week assessment, you can "comfortably" assess fairly complex applications.

What is surprising to me is that so little of that time was devoted to cryptography. For a secure messenger that time should be ratcheted up a bit (though the security infrastructure and general software implementation stuff is also very important).