Designing and implementing a secure cryptosystem is a non-trivial task that requires expertise and care.

Although Scram uses only existing, well-studied and reliable cryptographic primitives (for non-technical people, think of these as building blocks), knowing which primitives to use and how to use them to achieve an end-result is of paramount importance. Everything in a cryptosystem must be “exactly right” to yield a secure system. A slight error in a design or implementation can result in weaknesses that can be exploited by attackers.

Many companies rely on software developers to design their cryptosystems. Unfortunately, most software developers are generally unaware of the specific intricacies of cryptography or how to avoid mistakes that lead to insecure systems. (This is not intended to be a criticism of software developers themselves – more a commentary about the situation.)

Expertise level

One analogy to understand the distinction between cryptographers and software developers is to imagine doctors – there are General Practitioners who have a broad knowledge of many aspects of health and family medicine, who then refer patients to highly trained specialists such as cardiologists, dermatologists, emergency medicine and brain surgeons.

Designing and implementing (as opposed to using) cryptosystems requires extreme specialization in the field. Software developers are not cryptographers. As famous cryptographer Bruce Schneier said in his 1999 essay, the short answer to “how can I become a cryptographer” is: “Get a PhD in cryptography.”

To put things in perspective, our research shows that cryptographers are rarer than brain surgeons. There are more software developers in the world than doctors (18.2 million versus ~10-15 million), yet there are fewer cryptographers than brain surgeons (3755 authors of cited papers, versus ~3500 neurosurgeons in the USA and ~6000 in Japan alone).

This gives a ratio of 1 cryptographer per 4846 software developers, and yet encryption is required in every secure system and is the backbone of security on the Internet.

Mistakes can be made easily

Without the proper expertise, mistakes can be made easily. In fact, even with the proper expertise, mistakes are still possible. Many systems, such as DVD copy protection, GSM, Bluetooth and WEP Wi-fi were designed to be secure but were completely compromised fairly easily.