[tptacek]

This is the entire point of high-level crypto libraries, like Guttman's libcrypt and Google's Keyczar. So, yeah, don't use OpenSSL or javax::crypto or whatever .NET calls it; but, do consider using something like Keyczar, or, better yet, just use PGP/GPG to store data at rest, TLS for data in motion, and be done with it.

[SoftwareMaven]

Those still require key management. There is no way a developer can abdicate all responsibility for this stuff, no matter how high level (at least, not until we have good, common, trusted security as a service).

[tptacek]

Part of the point of Keyczar (note the name) is to make the right decisions about key management in advance and abstract them away from developers.

[gambler]

High-level libraries are definitely the way to go for a variety of reasons, but they don't replace understanding. Developers still need to understand what exactly is and is not guaranteed by cryptography involved, because that's the stuff protocols are build on. The root article is a great illustration of this.

[tptacek]

This is classic developerthink, and it's a good thing, but it doesn't serve you very well with crypto. The problem with crypto is that a partial understanding of the problems is actually worse than no understanding. You can be worse off learning crypto material than you were before you learned it.

If you're interested in picking up crypto knowledge, my advice is to do so in the context of breaking systems, not building them. I spend a lot of time doing crypto stuff, and I don't feel qualified to build them. But needing to figure out how to break all the random systems that end up on my desk has taught me a lot about crypto.