@vitonsky The honest answer is: no cryptographic primitive is proof against a compromised spec. What you can do is prefer primitives where:

- The constant derivation is transparent and independently reproducible
- The design process was public with adversarial review
- The security margin is large enough to survive unknown weaknesses (hence Serpent's 32 rounds vs AES's 10–14)

The library's conservative primitive choices aren't paranoia theater, Serpent's security margin philosophy is directly a hedge against "what if AES has structural weakness we don't know about yet."

@vitonsky "What if the spec was compromised at publication?" this is the real and legitimate question, and it has real history. Dual EC DRBG is the canonical example: an NSA-backdoored PRNG that NIST standardized in 2006, which Snowden documents confirmed was intentionally weakened. The backdoor was in the constants, specific elliptic curve points that were "chosen" in ways that gave the NSA a shortcut.

This is exactly why Serpent's constant selection matters and why the library documents it. Serpent's S-boxes come from a published derivation procedure, they're not arbitrary. The nothing-up-my-sleeve numbers are verifiable. The AES competition process was public, with multiple independent teams. SHA-2/SHA-3 constants are derived from cube roots of primes, you can easily verify them yourself from scratch.