Open-source crypto is no better than closed-source crypto
The titular thesis of this article is that Linus&#x27; Law doesn&#x27;t really apply to cryptographic security vulnerabilities.<p>To lend some authority to that (probably controversial) claim: the author of this article is JP Aumasson, a well known cryptography researcher and engineer. There aren&#x27;t many cryptographers who work in both theory and application the way Aumasson does. He recently wrote <i>Serious Cryptography</i> and has done professional cryptanalysis since 2012. He is also a co- or primary author for several cryptographic algorithms; including BLAKE&#x2F;BLAKE2, NORX, SipHash, and Gravity SPHINCS.<p>In the course of establishing his argument he groups cryptographic vulnerabilities into four main categories. The basic idea is that vulnerabilities in cryptography require a different set of skills to find than &quot;regular&quot; security vulnerabilities do. They also have different requirements for exploitation. Aumasson&#x27;s overall point is that the higher difficulty of finding bugs in cryptography for each category means there won&#x27;t be a meaningful difference in security between open and closed source code.<p>And for what it&#x27;s worth he&#x27;s only talking about open versus closed source <i>implementation</i> here. He&#x27;s not talking about Schneier&#x27;s Law or closed source designs.