While the "heavy lifting" of *constructing* a crypto algorithm infrastructure might have been done by the people who work at agencies with three-letter names, it is absolutely crucial that you *use them in **exactly** the right way.*  Otherwise you might believe that your system is secure when it is not.  

> *The Germans thought that Enigma was secure when it was not, and the biggest reason why it was not secure was a combination of user error in the U-Boats **and** flawed network design at headquarters.*

The essential principles of information security are well-described and not particularly difficult to understand.  But they *are* subtle.

- - -

You should never attempt to "roll your own" process ... a thing which is very rightly derided as *"snake oil."*  You should use a recent, off-the-shelf, peer-reviewed subsystem and use it *exactly* as its designers intended and specified.

Remember that there is never "security by obscurity."  You must presume that "Eve" knows everything about the system that "Bob" and "Alice" are using.

The various books that discuss *"PCI Compliance"* are excellent sources.  Likewise *"HIPAA Compliance."*  For any system with serious information security requirements, you should pay for experts to conduct *peer review* of your implementation.