The crypto in Magento is extremely boring. In fact: it's too boring. It predates misuse-resistant interfaces like Nacl. It's not enough to be boring: you have to be the right amount of boring.

I was joking 10 years ago when I wrote "if you're typing A-E-S into your code you're doing it wrong", but more and more I feel like I was on to something.