Sorry, but I prefer my crypto being tried and tested:
"What makes you think you can invent a good cipher if y ou have no expertise in the subject? Maybe you can, but it's not terribly likely. Imagine how you would react if your doctor told you "You have appendicitis, a disease that is life-threatening if not treated. We have a time-tested cure that cures 99% of all patients with no noticeable side-effects, but I'm not going to give you that: I'm going to give you a new experimental treatment my cousin dreamed up last week. No, my cousin has no medical training. No, I have no evidence that the new treatment will work, and it's never been tested or analyzed in depth -- but I'm going to give it to you anyway because my cousin thinks it is good stuff." You'd find another doctor, I hope. Rational people leave medical care to the medical experts. The medical experts have a much better track record than the quacks."
-- David Wagner PhD, sci.crypt, 19th Oct 02.
PolarSSL invents no new ciphers. It implements the well-known ones.
More to the point, it is in my unprofessional opinion easier to verify the PolarSSL implementations because they are all completely standalone. By design you can compile a single .c file and it will do what you expect.
OpenSSL has its advantages, to be sure. It's more widely used and thus theoretically yields better for Linus's Law. Its maintainers also take great care to squeeze extra performance out of different architectures.
But for my case having the smallest possible reliable implementation of the SHA-512 algorithm is what I want.
I principally agree, but the analogy from the excerpt you quote represents a chicken-and-egg problem.
Where did the medical experts come from? Every tried-and-tested medication was once a new, experimental treatment. Every doctor was once a quack without medical training (the analogy starts hinging here, but I hope you get what I'm trying to convey).
So yeah, it's most likely a better idea to use a battle-hardened approach in crypto in most cases, but that shouldn't become a fundamental stance opposing anything new because, well, it's new.
"What makes you think you can invent a good cipher if y ou have no expertise in the subject? Maybe you can, but it's not terribly likely. Imagine how you would react if your doctor told you "You have appendicitis, a disease that is life-threatening if not treated. We have a time-tested cure that cures 99% of all patients with no noticeable side-effects, but I'm not going to give you that: I'm going to give you a new experimental treatment my cousin dreamed up last week. No, my cousin has no medical training. No, I have no evidence that the new treatment will work, and it's never been tested or analyzed in depth -- but I'm going to give it to you anyway because my cousin thinks it is good stuff." You'd find another doctor, I hope. Rational people leave medical care to the medical experts. The medical experts have a much better track record than the quacks." -- David Wagner PhD, sci.crypt, 19th Oct 02.