Why Do I Need a Cryptographer?

Imagine a management meeting at company XYZ. At some point, somebody raises the issue of goods transportation between the newly acquired manufactory and the distribution points. Then one of the directors proposes "We definitely need trucks for transportation. We should appoint some of our engineers to study how trucks are designed and build some for us". Does that sound serious?

Of course not! In the very best case, this team will be able to produce some costly, dangerous vehicles that will need ten times too much fuel and get stuck every fifty miles - let alone the problem of legal authorizations to have that vehicle ride the roads. Nobody argues that: vehicles manufacturing is a job for vehicles designers.

Yet, it is often the very same attitude that gets adopted when it comes to cryptographic issues. Companies expect their computer scientists to read a few books on security, search the web, and design and implement the security architecture for their new product.

Why do people believe they should handle cryptography themselves?

• It does not look so complicated.
• But our security design is a company secret, shouldn't this provide high security?
• Security is critical: we want to rely only on ourselves
• You know, we do not need that much security: just to keep most occasional hackers outside
• There is no benefit in security