I'm doing some encryption-involved work atm and this is particularly relevant.
It's also relevant because I often find myself, usually at the beginning of a project (like, right now), asking me, "What level should I be working and is there an API to do this for me?"
Usually, the answers are, "Don't know" and "No", in that order. Which is annoying but also called, "Life."
Anyway, read that article, the articles linked from it. It be good. Here it is again...