Thanks for clarifying, and confirming at least one of my suspicions.

All I can say here is, "Yikes."

If you (or, well, anyone) ever need an honest third party to audit a cryptography design--whether it's because you suspect bullshit or just want assurance that it's actually a good design--talk to the Crypto team at Trail of Bits.

https://www.trailofbits.com/services/software-assurance/cryp...