I knew someone would say this.

"Never roll your own cryptography", despite the ambiguity of its phrasing, means never use uncertified crypto in production unless you're willing to take the risk. It doesn't mean to never build cryptography without an expert's permission. Everyone who has ever published world-class cryptography has rolled their own crypto.

That is what I meant by my comment, I was not referring to learning exercises, I should've been more clear, though.

My apologies then. I've seen this phrase repeated ad nauseam even when its not warranted and I want to point out that it shouldn't be followed blindly.

“20 years of abstinence-only cryptography education hasn’t gotten us anything but an endless supply of bad crypto in production systems”

People absolutely should. The best way to understand how something works is to build it.

What that phrase means is you shouldn't use hobby crypto libraries for any important production services. But that's also not the point behind "Build Your Own" type projects. So your advice isn't correct in this scenario.

Everyone should build one, as early as possible and fail and then come to this realization.

the only issue is what it means to "fail". it's not really an issue until you're hacked and then it's too late

to fail doesn't mean to fail in production

right, but how else are you going to know your crypto is broken? what unit test is going to fail?

if you need expert opinion on your library order a security audit. otherwise even expert-designed systems have failed and most people know that it is very unwise to give security guarantees to devices that have so many moving parts