Crypto is hard because you don't get quick feedback on whether you are doing well. The feedback will only come if somebody hacks it. You need to know what you are doing and most developers are not at that level. Most development happens by constantly iterating (write couple lines of code, find if it does what you expect it to do).

If you want to understand crypto imagine getting requirements and having to write an app. You can't run it before it goes to production. You need to understand every detail of the app is correct and you are not going to get any validation.

I like to think that crypto is not development. Development only happens after you did crypto (ie. writing down the process) and it is completely different from development.

I have rolled my own cryptogrophic protocol for transferring keys between devices that was subsequently approved by PCI. We needed the protocol in order to work around peculiarities of the particular HSMs we had and it used "funky" operations like encrypting block of data using 3DES in reverse (ie. using decrypting operation on plaintext block of data) so that it can be then digested by the HSM.

Very simple protocol, took a lot of effort to prove why we need it and to prove we know what we are doing.