In general, do not write your own crypto system unless you are a crypto expert. The rule is to not suggest people use your system until you are an expert.<p>What is your attack model?<p>As Bruce Schneier said, &quot;There are two types of encryption: one that will prevent your sister from reading your diary and one that will prevent your government.”<p>For example, do you consider timing attacks as a vulnerability?<p>What is your user model? As written, your code requires the user to peer into the implementation. For example, Cape.h exposes the &quot;swap(a,b)&quot; and &quot;MAX_LENGTH&quot; macros, which may collide with user code.<p>You also have a &quot;char result[MAX_LENGTH]&quot; but &#x27;result&#x27; is filled by user-specified data. Hence, unless the API user does a check against MAX_LENGTH, this can cause a buffer overflow.<p>If the encryption strength is 0, which is documented as a possible input value, then the &quot;% _encryption_strength&quot; is undefined. Quoting from the spec:<p>&gt; the binary % operator yields the remainder from the division of the first expression by the second. If the second operand of &#x2F; or % is zero the behavior is undefined