[csarva]

So what's the preferred route for an opensource project?

# TODO add crypto

vs

# TODO get someone to review the crypto later

[jgrahamc]

You could use a well established library. GPG or OpenSSL for example.

[csarva]

OpenSSL is fairly low level and still lets you shoot yourself in the foot. You can make the same mistakes as in the OP post.