I know from the bottom of my heart how bad the idea of custom-crypto is. I absolutely concur with the recommendation that it should only be done by professionals who specialize in implementing crypto safely.
However, exactly because it's a Bad Idea ™ it's really hard to find good information on this topic. Say one of the aforementioned professionals is looking at a crypto implementation and they want to judge how safe it is. Some things that come to mind:
- Constant-time implementation (to protect against timing/side-channel attacks)
- Source of randomness (true vs. pseudo RNGs)
- Bits of entropy
- Zeroing intermediate buffers
- Appropriate test coverage with test vectors (e.g., NIST, Wycheproof)
What are other areas like this that need to be probed? Is there any documentation/checklist/book that can shed further light on the topic -- something like 1 but more comprehensive?