I would like to know how one goes about analyzing and picking a cryptography related library. For example, today we have many TLS implementations, that use cryptographic primitives, for example: GnuTLS, OpenSSL, LibreSSL, etc... So how do we pick one?
- How do you analyze the library? Do you check the source code?
- What if I am not a crypto expert? Should I rely on the organizations behind those libraries?
I've been recently using crypto related libraries provided by GNU, basically because their are open source (which makes it possible for anyone to review the code), have a good documentation and because GNU's projects are in general trustworthy and reliable. What other parameters, besides the lib's track record should I take into account?