This may be best served as two separate questions, one on this SE to handle the "how to communicate" question, and one on Law SE to handle the "am I liable" question. Two very different questions!

Talk to an attorney. You probably want language product/design has no warranty. You would only be liable for intentional gross negligence.

Ugh, unfortunately handing off IT security to underqualified contractors seems to be par for the course in many parts of the industry. The fact that they even consider this (surely they know you’re not an IT security professional?) is actually a red flag.

What does your contract say? Does it define any scope for your tasks and responsibilities? In any case, take this as a lesson... next time you sign a contract be aware of its scope, so that you don't end up in the same situation again.

Are you a member of any professional organizations? There are ethical considerations. For instance, item 6 in the IEEE code of ethics: "to maintain and improve our technical competence and to undertake technological tasks for others only if qualified by training or experience, or after full disclosure of pertinent limitations; ".

Are you acting as a self-employed individual; a one-man contracting company; or a member of a larger contracting organization? If the latter, a number of options open up, and you should discuss the situation with the your superior in the contracting company - they may have others who would be better suited to that particular task.

There is so much work available to programmers, as of writing, that it would be pointless to get involved in something like this. Just say the words "That is not my field of expertise."

This is one of those occasions where being a contract employee or actual contractor makes a HUGE difference. Professional legal advice is STRONGLY suggested. You call them your employer, then state you're a contractor. Something tells me you need to get a pro to help you understand your liability.

All the verbage in my contract calls me a "consultant." I will be receiving a 1099 form. That's unfortunately all I'm really sure of -- I am not intending on starting a contracting business - I already have a permanent lined up within a few months. My employer (client??) only hires contractors.

@HopelessN00b It is a relatively low-pressure issue - this is just an internal project. I believe my employer thinks the design they're asking for is a lot less complex than it is. The only information will regard my company, but if a rogue developer is able to acquire and maliciously use the data (as they sometimes do), I do not want to be the one at fault. I've made it very clear that I am not an expert and have been asked to continue work on it - I do not think my employer is as worried as I am.

Don't worry. I've encountered people with the title "Security Consultant" who don't have the first clue how SSL works.

How about the new GDPR laws in Europe?

Insurance and lawyers, lawyers and insurance. If you are a contractor and you don't have insurance, get some. If you don't have a limited-liability company, get one.

@durantjm198 if they call you a consultant and will be issuing you a 1099 instead of a W-2, then you're a contractor, and likely can be independently liable. Even if you can't be found legally liable, if there's a huge ****storm then the company's PR might try to deflect it to you saying "but our contractor wrote that part!" and play it off like you presented yourself to them as some sort of "security expert" fully capable of handling the task.

I'm reminded of a case where, in a big IT company, we asked a recent graduate to spend a couple of months evaluating two competing technologies for a specific project. He did a superb presentation at the end analysing the strengths and weaknesses of both, but was very reluctant to make a recommendation because he felt uncomfortable about making such a big decision. He really had to be persuaded that he knew more about it than anyone else and if he couldn't make a decision, then no-one could. It's good to be aware of your limits, but sometimes you have to do the best you can.

Please see Cryptographic Right Answers and then obey it. Don't write your own encryption schemes. I understand your task is larger than mere encryption, but if you use industry standard and industry-supported existing software, you are in a much better shape.

If you're a contractor then they are your customer, not your employer. If you can't do the work they're specifying, do what you'd do if they asked you to build a car: just say no.