Programming

What are you hiring this cryptographer to do? It sounds like you’re hiring them to roll your own crypto (it’s for your project, therefore it’s “yours”). That’s where you went wrong.

If you go with an established cryptographic algorithm / OSS implementation, then that solution will be one that has received a great deal of review by cryptographers. If it has obvious vulnerabilities, those will have been noticed and documented. Many non-obvious vulnerabilities will have been documented, too.

If you roll your own, even if you’re an expert, your algorithm will not have had the benefit of those thousands of hours spent reviewing it.

But that doesn’t mean that your work can’t be reviewed. Even a developer who didn’t specialize in cryptography could potentially notice an issue, assuming they at least had some background, though it having experts review it would be better.

If you’re following best practices and are using an established solution, then the reviewer doesn’t have to fully understand the field of crypto. It’s much easier to confirm that an algorithm is being implemented faithfully or that best practices are being followed.

If a cryptographer you hired is trying to intentionally build an algorithm with backdoors, that may be difficult to notice, but if “no one has ANY IDEA WHATSOEVER if there are back doors until they are used to rob people blind” then that’s because you didn’t have enough experts review their work.