(1) You&#x27;re saying use standardized fully-vetted methods.<p>(2) Parent is asking for something just slightly different enough that it escapes dragnets and automated attacks.<p>There is no question that (1) is much better than (2).<p>But in <i>special circumstances</i>, one could do both (1) and (2) in cascade operation (i.e., do one first, then the other). If the code for (1) and (2) run as separate processes with independently chosen keys, seeds, parameters, etc., then it doesn&#x27;t matter how awful (2) is. It might help, it might not help, but it won&#x27;t make the security <i>worse</i> than using (1) alone.<p>The obvious downsides are slowness, code complexity, non-standard API&#x2F;interface, code maintenance headaches, and false sense of extra security (but not worse security).