I know the general advice that we should never design¹ a crypto algorithm. It has been talked about very extensively on this site and on the websites of professionals of such caliber as Bruce Schneier.
However, the general advice goes further than that: It says that we should not even implement...
I just noticed your desire for a reference to an acclaimed security expert. I'm sorry, I don't have any, as my answer stems more from my own knowledge than that of a security expert (and I don't consider myself an expert).
Crypto must be correct. Any error which in other pieces of software would be a small bug/glitch with little to no consequence is catastrophic in crypto code. Moreover it must be fast. Optimization is no friend of correctness (that's why developers say to optimize only when needed and only where you profile the bottleneck... the more you optimize the harder to get it right and refactor/extend).
As just a basic risk v reward analysis I'd look at in terms of your implementation being less field tested. That risk/reward balance is quite different if you are talking about a personal learning exercise with no significant cost of failure versus protecting significant business assets.
More generally, don't implement any complex, high-stakes algorithm (for production code) if there is a vetted implementation of it available. And it doesn't get any more complex/higher-stakes/available than crypto.
In short: getting the math right is literally the simplest possible implementation problem, and even that is still pretty hard, but newbs to this space behave as though the math is the hardest part. Do a review of attacks against professionally-implemented security systems, and see how many of them failed because of a flaw in the implementation that was not a flaw in the math.
Realize these people telling you to rely on old, trusted, reliable, vetted code could well have been talking about OpenSSL. However OpenSSL was, in fact, actually a pile of unmaintained, unmaintainable, poorly written garbage, sitting out in public for anyone to see who took five minutes to browse the source code. Maybe you shouldn't write your own crypto code - but you should know how to write your own crypto code, so that you can tell when people are wrong when they tell you things like OpenSSL is trustworthy. And the only way to learn is to write your own crypto code. And maybe not use it.
@Eric Lippert : So could a reasonable case be made that, in fact, counter to common intuition, implementation is an even harder problem than rolling your own algorithm? And thus the warnings against "self-baked crypto" should actually, really strike for implementation first and algorithm second to prioritize in order of decreasing non-triviality?
@don bright : That is a very interesting point, because one thing that always comes up for me is how that demands to "critically analyze" claims that one often hears promoted in various avenues seem often not possible for an outsider to meet much beyond trusting the relevant experts, precisely because to understand how good a claim is, you need a deep understanding of the subject matter; and the more non-trivial the claim, the deeper the required understanding.
E.g. it is not reasonable to expect someone without specialty expertise in, say, medicine to be able to properly think critically about sophisticated claims from "crackpots" regarding alternative medicines who propose studies that they claim support the (in reality unworkable) medicines but really don't and they have to rely on trust in others' expertise thereabout. The ideal of the "free critical thinker" who "only believes what they see for themselves" is really just that: a very unattainable ideal that perhaps might have been more attainable in the distant past, but not now.
@Xander I don't believe this is a duplicate, because unlike that question which is talking about creating your own algorithms, this is one about implementing a well-known and standard algorithm.
Answers from acclaimed experts are no better than equally correct answers from non-acclaimed experts, and likewise no better than equally correct answers from acclaimed non-experts. If the answer is correct, then it is correct, and is no better or worse based on the person it comes from.
@The_Sympathizer I find your most recent comments unnecessary, unhelpful to this thread, and insulting. I would argue about how ridiculous that line of reasoning is, and insist on how fallacious it is, but that would just further clutter the comments and be off topic. Please take your political views elsewhere, perhaps to politics.SE. And yes, I might be more biased against your comment because it uses a specific topic and claim that I see a lot and which frequently pisses me off - I admit it. I think you should delete at least your last 1, if not 2, comments, and I'll delete this one too.
@Aaron "Answers from acclaimed experts are no better than equally correct answers from non-acclaimed experts, and likewise no better than equally correct answers from acclaimed non-experts. If the answer is correct, then it is correct, and is no better or worse based on the person it comes from" - And yet Wikipedia demands all claims to be backed up by reputable sources, while academic papers, IIUC, will rathet not have references to Wikipedia. OK, full disclosure: I need to find an appropriate reference to back up what I'm writing but couldn't find it - so I asked for a reference.
@gaazkam Ah! Ok, that is understandable. Wanting a reputable reference is great. Just remember that "reputable reference" does not mean "a reference by an acclaimed expert." Even non-experts have papers published in reputable peer-reviewed journals, which are generally considered great references... and even acclaimed experts make claims which are not reputable.
Discussion on question by gaazkam: Wh…
Discussion on question by gaazkam: Wh…