I was reading around the zeroMQ implementation of secure messaging that uses this library. It seemed sensible enough (plaintext handshake, exchange session keys and hashes to verify long term keys). But it was entirely couched in "I am not a cryptographer" and "strawman only" caveats.

I appreciate the dangers of thinking "encryption cures all other bad decisions" but it would be useful to have a spectrum of security we can talk about.

I would love to see something like Big O notation for security - where we are 95% confident that the implementation has closed off vulnerabilities "on the order of published exploits, on the order of passive sniffing inside network, on the order of State level actor targeting your data"

I just wonder if we ever can say "hell yes this will do" as opposed to "well even Fort Knox might have a vulnerable point"

Edit: perhaps I mean "design patterns for security layers"