Can crypto.SE help with implementing a secure protocol?
Yes, but not when it comes to practical "software development".
In it's simplest way, one could say Crypto.SE can help you understand what is going on and why, while other SE communities can help you with things like practical implementation and/or finding the tools or libraries you need.
I'll dive into your four points (what you call "rules") to explain the details:
Indeed, fact is Crypto.SE doesn't accept questions asking us to review a whole algo or scheme. So don't simply throw a paper (or alike lengthly algo/scheme/protocol description) at us, asking "is this secure?" as that's too broad and boils down to answerers having to write a small book. (To understand the issue with this, it may help to know people earn a living out there writing up such expanded analysis reports and/or papers.)
But we do very well handle sub-analysis of individual building blocks. Quoting the related Meta Q&A which is also linked in our related "on hold" messages:
However, you might like to break your problem down into specifics, such as "under these conditions, does structure X have desired security property Y?" which would be a perfect fit for us.
This is also the reason (among other things) comments to questions frequently ask to clarify the exact scenario that is trying to be solved/handled.
It is also correct to notice we don't do code reviews around here. The reason for that is that there is a dedicated community at SE that handles exactly what you're describing; it's called Code Review Stack Exchange.
Users there do a pretty good job pointing out glitches and bugs in coding implementations, and even help optimizing your code in terms of security and performance.
You can ask for recommendations at SE, just not at Crypto.SE. Quoting our help center
- If your question is looking for software and/or programming library recommendations, you should post it at Software Recommendations
Fact is I frequently have to merge questions there. Last time I did so was around and about three days ago and — looking at the "thank you" messages I get — users are frequently pretty happy to learn that community exists, as it helps them find the software tools and libraries they're looking for.
How to successfully implement a cryptographic algorithm or protocol depends on many things. Most of them were described by yourself…
- it assumes your algo, scheme, or protocol is secure. (You could also implement insecure things, but I'll skip diving into that as that isn't a frequent goal.)
- it assumes you know your way around in the coding language you're using. StackOverflow can help when it comes to learning that. Many of us also answer questions at StackOverflow. The beauty of SO is that it is known to be used by many experts in their individual fields; both cryptographic as well as non-cryptographic (eg Mark Adler, etc.)
- it assumes you don't introduce bugs in your code (which is where CodeReview.SE comes in).
- and sometimes it assumes you use the correct tools and/or libraries to achieve your goal. (see SoftwareRecommendations.SE).
Long story short: what you're describing can't be handled by a single StackExchange community. But if you take a good look around, you'll notice there's an SE site for every part of your problem.
By the way: your example
Humpty Dumpty wants to securely talk to Pablo across the open internet, but doesn't want Candy to be able to listen in. Pablo also wants to know that the messages he's receiving do indeed come from Humpty Dumpy, and that Candy hasn't interfered with them. So I'm looking for some encryption and some authentication.
would be on topic at our site. (Thinking about it, there's even a chance an alike question already exists.)
It would also fit SoftwareRecommendations.SE if you reformulate it, asking for related programs and/or libraries that fit your target operating system(s).
In the end, there are known and well-vetted solutions to your example problem and ready-to-use software solutions exist. This would practically void your need to create your own for your example.
And in case some specific manual raises questions, SuperUser.SE tends to provide a very helping hand in explaining how to correctly use individual software (for example: OpenSSL, GPG/PGP, etc).
So, there is no "Catch 22". Instead, what you're looking at is the huge truckload of hints to the fact that producing a working and secure protocol
isn't a piece of cake as it takes a lot of knowledge in multiple areas and it also expects a lot of effort.
If that weren't the case, everyone could do it… which would void the need for specialized programmers, experienced cryptographers, and —
last but not least — cryptanalysts. The fact those jobs exist and aren't superfluous pretty much underlines the general problem that "creating your own" definitely ain't easy in the realms of cryptography.
TL;DR
As our help center explains, we're here to help you grasp the more theoretical side of all things related to cryptography, while other SE communities exist to help you implement and/or use that knowledge practically (as an example: crypto-related software development).