Let's say I want to use a security hashing algorithm, like bcrypt, and I want to use a young bcrypt implementation, e.g. called
libfancybcrypt, instead of an well established implementation.
Of course, I can simply generate a few thousand or millions of random strings, hash them with
libfancybcrypt and with the old, well established library, and compare the hashes in the end. So assume, I've done that and the new library in question produces the same result as the well established one for all random inputs.
My question has two parts:
Assume the library author can be trusted. Given my random input test above: how likely is it, that the author accidentally introduces a bug with the effect that there are inputs for which a wrong hash is calculated?
Assuming the library author cannot be trusted. Given my random input test above: how likely is it, that the author has purposely introduced a backdoor of some kind?
Related but still different: