Apart from all the other stuff, it seems suspicious that they would use Serpent for encryption, rather than using AES or another more well-known cipher suite (also, no talk about AEAD).
back
1 comments
The article you link perhaps hint at why the developers felt like this: The NIST report apparently suggested Serpent was actually a bit more secure, but Rijndael was chosen for AES because it allowed for a more efficient software implementation. The developers may feel that that trade-off wasn't worth it, although obviously, going with a less-common strategy for encryption is generally discouraged.
Which is crazy. AES is good enough for TOP SECRET, it's the most widely supported & vetted modern cipher, and all modern hardware has instruction sets dedicated to it that prevent timing side channels (which Serpent can't claim). Not using AES here is a product design red flag.