cryptosystems

Your might mean that Shor's quantum factoring algorithm is not an imminent threat to practical cryptosystems.

But there are entire classes of cryptosystems based on not knowing with whom you are communicating.

Weird that a security-centric OS would be cavalier with time when some cryptosystems are time-sensitive.

Similarly, the factoring community discovered the number-field sieve, which affected the security of public-key cryptosystems.

Once you start composing proven primitives into whole cryptosystems, typically, all bets are off.

Virtually all elliptic-curve cryptography is patent-free, as you would expect for a family of cryptosystems studied since 1986 based on centuries-old math.

Most amateur cryptosystems are trivially defeated without any knowledge of their internals (FBI has some nice articles on cryptanalysis of criminal ciphers).

My exact point was that those cryptographers would already need to develop generic attacks for all the non-standard (read: non-secure) cryptosystems out there.

There's always a need for special purpose cryptosystems.

Those attacks are powerful and have repeatedly broken TLS; they're also the most common form of attack on other cryptosystems (every padding oracle attack is a variant of them).

Dual_EC was actively recommended, on the auspices that deployed cryptosystems already depended on number theoretic security guarantees, and that it made sense to minimize the number of things one's cryptosystem depends on.

To them, building cryptosystems using primitives with strong heuristic arguments for their security which are easy to implement is far more beneficial for security than the most perfectly crafted mathematical algorithm will be.

While there seem to be "home made" elements, these are in how they are combining well-known cryptosystems.

At the link they talk the "crypto algorithms" not cryptosystems that they combine.

In the context of RSA-based cryptosystems, it's clearer to just say "signed".