Your Crypto is Broken Cryptography provides protection of data that is inside one trusted unit which can be delivered to another trusted unit via a channel controlled by an active attacker. When done properly, this allows communication of data which can be trusted by both sides and has no value to an attacker. When done poorly, this is nothing more than the illusion of security and history has its share of bad implementations of cryptography. These were accidental issues, or mistakes made by creating home-grown algorithms by someone who knew just a little about cryptographic theory. While the Blue Team is struggling to stay on top of the never-ending chaos of log messages from every script-kiddie around the world, there is a continuing struggle to determine whether the trusted communication channels can actually be trusted. Additionally, there’s always the nightmare scenario of the code simply walking out the door. What secrets would be exposed in that case and is cryptography really helping? In this talk we show why home-grown cryptography should not be trusted and even third-party code should be examined with a skeptical eye. Practical tips are given for doing audits related to cryptography and how to have an early warning on breaches.