Cryptography is a core security service, and is generally considered a specialty that is difficult to get right unless one knows what they are doing. Furthermore, cryptography API misuse is rampant and the cause of many security vulnerabilities. This question refers to using Cryptography libraries as a software developer.
In any given language, say Python, for example, I am looking for a reasonable way to determine which librari(es) is most suitable for use from a security standpoint. I've heard of and seen pages for
python-nss, etc... There are also many libraries like this for other languages.
It is not immediately clear to me or another non-ecosystem-veteran, which of these libraries is the most updated, secure, backed one. Obviously, in cases where all of the cryptography services are built into a language's standard library, this is less of a problem. A few ideas I've had is simply checking the GitHub pages for how updated and well-maintained the repository seems to be, however, this is only one aspect and if I'm shown 5 repositories that are all updated and maintained, I'm somewhat back to square one. Another thought was try to research the main developers, ensure the code is signed, etc... But this also isn't always easy as some go by screen names, etc... It would seem to me that there would need to be a quite reliable way to determine "this is a safe, vetted, crypto library." After all, a single line of malicious or naively written code could compromise an entire cryptosystem.