&gt; Cobbling together existing primitives counts as &quot;rolling your own crypto&quot;.<p>MD5() isn&#x27;t a primitive, it is an entire implementation.<p>As I said, if they didn&#x27;t do maths they didn&#x27;t do encryption. You&#x27;re conflating authentication with encryption, which aren&#x27;t the same thing at all (just like an engine and a car aren&#x27;t the same thing, or a heart and a human).<p>Encryption (and or hashing) is an important part of authentication, but the term &quot;rolling your own encryption&quot; clearly relates to the encryption-part of the authentication routine. People regularly roll their own authentication routines (even if that within its own right is a bad plan).<p>I am in no way defending that code. It is garbage. But people in this thread have clearly misunderstand the warning against &quot;rolling your own encryption.&quot; Or don&#x27;t know what encryption is.