It's actually very easy to get this wrong. Especially on the key and trust management side. The crypto algorithms themselves are the simple bit provided you don't try to invent your own.