When should you design a security protocol, and when should you not?
Almost every custom security protocol should have been a profile of an existing one. The few that are justified share a specific set of constraints - and a review process that assumes the first design is wrong.