From Nate Lawson's most recent entry :

Most public key systems fail catastrophically if you ignore any oftheir requirements. You can decrypt RSA messages if the padding is notrandom ,for example. With DSA, many implementation mistakes expose thesigner's private key.

(emphasis mine.)

Even small implementation mistakes are dangerous to crypto systems,but there are degrees of danger. Most of the time, 'all' that happensis that a bad implementation doesn't deliver either the encryption orthe endpoint authentication