How we did it:
For any feedback, any questions, any notes or just for chat - feel free to follow us on social networks
John Viega, Matt Messier, Pravir Chandra
Most applications these days are at least somewhat network aware, but how do you protect those applications against common network security threats? Many developers are turning to OpenSSL, an open source version of SSL/TLS, which is the most widely used protocol for secure network communications. The OpenSSL library is seeing widespread adoption for web sites that require cryptographic functions to protect a broad range of sensitive information, such as credit card numbers and other financial transactions. The library is the only free, full-featured SSL implementation for C and C++, and it can be used programmatically or from the command line to secure most TCP-based network protocols. Network Security with OpenSSL enables developers to use this protocol much more effectively. Traditionally, getting something simple done in OpenSSL could easily take weeks. This concise book gives you the guidance you need to avoid pitfalls, while allowing you to take advantage of the library?s advanced features. And, instead of bogging you down in the technical details of how SSL works under the hood, this book provides only the information that is necessary to use OpenSSL safely and effectively. In step-by-step fashion, the book details the challenges in securing network communications, and shows you how to use OpenSSL tools to best meet those challenges. As a system or network administrator, you will benefit from the thorough treatment of the OpenSSL command-line interface, as well as from step-by-step directions for obtaining certificates and setting up your own certification authority. As a developer, you will further benefit from the in-depth discussions and examples of how to use OpenSSL in your own programs. Although OpenSSL is written in C, information on how to use OpenSSL with Perl, Python and PHP is also included. OpenSSL may well answer your need to protect sensitive data. If that?s the case, Network Security with OpenSSL is the only guide available on the subject.
Your 2-in-1 Self-Paced Training Kit. Fully updated and revised! Ace your preparation for the skills measured by MCTS Exam 70-536—and on the job. With this official Microsoft study guide, you'll work at your own pace through a series of lessons and reviews that fully cover each exam objective. Then reinforce and apply what you've learned through real-world case scenarios and practice exercises. Maximize your performance on the exam by learning to: Develop applications that use system types and collections Validate input, reformat text, and extract data with regular expressions Create services and multi-threaded applications Implement code-access security and role-based security Implement serialization to read and write complex objects Leverage legacy code using interoperability Monitor and troubleshoot applications Create applications for a global audience PRACTICE TESTS Assess your skills with practice tests on CD. You can work through hundreds of questions using multiple testing modes to meet your specific learning needs. You get detailed explanations for right and wrong answers?including a customized learning path that describes how and where to focus your studies. Your kit includes: 15% exam discount from Microsoft. (Limited time offer). Official self-paced study guide. Practice tests with multiple, customizable testing options and a learning plan based on your results. 300+ practice and review questions. Code samples in Microsoft Visual Basic and Visual C# on CD. Case scenarios, exercises, and best practices. 90-day evaluation of Microsoft Visual Studio Professional 2008. Fully searchable eBook of this guide. A Note Regarding the CD or DVD The practice test materials are available as a download along with your ebook version of the kit, and will be located in your account. Please direct any questions or concerns to firstname.lastname@example.org.
""This is the best book on SSL/TLS. Rescorla knows SSL/TLS as well as anyone and presents it both clearly and completely.... At times, I felt like he's been looking over my shoulder when I designed SSL v3. If network security matters to you, buy this book."" Paul Kocher, Cryptography Research, Inc. Co-Designer of SSL v3 " "Having the right crypto is necessary but not sufficient to having secure communications. If you're using SSL/TLS, you should have "SSL and TLS"sitting on your shelf right next to "Applied Cryptography." Bruce Schneier, Counterpane Internet Security, Inc. Author of "Applied Cryptography"" "Everything you wanted to know about SSL/TLS in one place. It covers the protocols down to the level of packet traces. It covers how to write software that uses SSL/TLS. And it contrasts SSL with other approaches. All this while being technically sound and readable!"" Radia Perlman, Sun Microsystems, Inc. Author of "Interconnections" Secure Sockets Layer (SSL) and its IETF successor, Transport Layer Security (TLS), are the leading Internet security protocols, providing security for e-commerce, web services, and many other network functions. Using SSL/TLS effectively requires a firm grasp of its role in network communications, its security properties, and its performance characteristics. "SSL and TLS" provides total coverage of the protocols from the bits on the wire up to application programming. This comprehensive book not only describes how SSL/TLS is supposed to behave but also uses the author's free ssldump diagnostic tool to show the protocols in action. The author covers each protocol feature, first explaining how it works and then illustrating it in a live implementation. This unique presentation bridges the difficult gap between specification and implementation that is a common source of confusion and incompatibility. In addition to describing the protocols, "SSL and TLS" delivers the essential details required by security architects, application designers, and software engineers. Use the practical design rules in this book to quickly design fast and secure systems using SSL/TLS. These design rules are illustrated with chapters covering the new IETF standards for HTTP and SMTP over TLS. Written by an experienced SSL implementor, "SSL and TLS" contains detailed information on programming SSL applications. The author discusses the common problems faced by implementors and provides complete sample programs illustrating the solutions in both C and Java. The sample programs use the free OpenSSL and PureTLS toolkits so the reader can immediately run the examples. 0201615983B04062001
Niels Ferguson, Bruce Schneier, Tadayoshi Kohno
The ultimate guide to cryptography, updated from an author team of the world's top cryptography experts. Cryptography is vital to keeping information safe, in an era when the formula to do so becomes more and more challenging. Written by a team of world-renowned cryptography experts, this essential guide is the definitive introduction to all major areas of cryptography: message security, key negotiation, and key management. You'll learn how to think like a cryptographer. You'll discover techniques for building cryptography into products from the start and you'll examine the many technical changes in the field. After a basic overview of cryptography and what it means today, this indispensable resource covers such topics as block ciphers, block modes, hash functions, encryption modes, message authentication codes, implementation issues, negotiation protocols, and more. Helpful examples and hands-on exercises enhance your understanding of the multi-faceted field of cryptography. An author team of internationally recognized cryptography experts updates you on vital topics in the field of cryptography Shows you how to build cryptography into products from the start Examines updates and changes to cryptography Includes coverage on key servers, message security, authentication codes, new standards, block ciphers, message authentication codes, and more Cryptography Engineering gets you up to speed in the ever-evolving field of cryptography.
Jonathan Katz, Yehuda Lindell
Cryptography plays a key role in ensuring the privacy and integrity of data and the security of computer networks. Introduction to Modern Cryptography provides a rigorous yet accessible treatment of modern cryptography, with a focus on formal definitions, precise assumptions, and rigorous proofs. The authors introduce the core principles of modern cryptography, including the modern, computational approach to security that overcomes the limitations of perfect secrecy. An extensive treatment of private-key encryption and message authentication follows. The authors also illustrate design principles for block ciphers, such as the Data Encryption Standard (DES) and the Advanced Encryption Standard (AES), and present provably secure constructions of block ciphers from lower-level primitives. The second half of the book focuses on public-key cryptography, beginning with a self-contained introduction to the number theory needed to understand the RSA, Diffie-Hellman, El Gamal, and other cryptosystems. After exploring public-key encryption and digital signatures, the book concludes with a discussion of the random oracle model and its applications. Serving as a textbook, a reference, or for self-study, Introduction to Modern Cryptography presents the necessary tools to fully understand this fascinating subject.
H. X. Mel, Doris M. Baker
Fundamental security concepts like cryptography and digital signatures are becoming as much a part of our everyday lives as megabytes and the Internet. Anyone working with computer security--security professionals, network administrators, IT managers, CEOs, and CIOs--need to have a comfortable understanding of the cryptographic concepts in this book. Cryptography Decrypted shows you how to safeguard digital possessions. It is a clear, comprehensible, and practical guide to the essentials of computer cryptography, from Caesar's Cipher through modern-day public key. Cryptographic capabilities like detecting imposters and stopping eavesdropping are thoroughly illustrated with easy-to-understand analogies, visuals, and historical sidebars. You need little or no background in cryptography to read Cryptography Decrypted. Nor does it require technical or mathematical expertise. But for those with some understanding of the subject, this book is comprehensive enough to solidify knowledge of computer cryptography and challenge those who wish to explore the high-level math appendix. Divided into four parts, the book explains secret keys and secret key methods like DES, public and private keys, and public key methods like RSA; how keys are distributed through digital certificates; and three real-world systems. Numerous graphics illustrate and clarify common cryptographic terminology throughout. You will find coverage of such specific topics as: Secret key and secret key exchanges Public and private keys Digital signatures Digital certificates, Public Key Infrastructure (PKI), and PGP Hashes and message digests Secure e-mail, secure socket layer (SSL), and Internet Protocol Security (IPsec) Protecting keys Cryptographic attacks Authentication, confidentiality, integrity, and nonrepudiation " "Even after ten years working in the field of information protection for a major electronics manufacturing company, I learned a lot from this book. I think you will too."" --From the Foreword by John Kinyon 0201616475B04062001
This book covers everything you need to know to write professional-level cryptographic code. This expanded, improved second edition includes about 100 pages of new material as well as numerous improvements to the original text. The chapter about random number generation has been completely rewritten, and the latest cryptographic techniques are covered in detail. Furthermore, this book covers the recent improvements in primality testing.
• •Specifies which protocols are to be followed and which are to be avoided, providing security engineers with essential knowledge. •Dissects schemes and protocols in standards and real-world cases, pointing out their strong security strengths and weaknesses. •Opens the "bag of tricks" attackers use and gives cryptographers countermeasures.
Matthew MacDonald, Erik Johansson
This title is aimed at practicing Visual Basic .NET developers who are developing distributed applications or who need to store data in a secure manner. It aims to take VB developers with little or no knowledge of cryptography to the point where the can confidently implement their own secure applications.
Darrel Hankerson, Alfred J. Menezes, Scott Vanstone
After two decades of research and development, elliptic curve cryptography now has widespread exposure and acceptance. Industry, banking, and government standards are in place to facilitate extensive deployment of this efficient public-key mechanism. Anchored by a comprehensive treatment of the practical aspects of elliptic curve cryptography (ECC), this guide explains the basic mathematics, describes state-of-the-art implementation methods, and presents standardized protocols for public-key encryption, digital signatures, and key establishment. In addition, the book addresses some issues that arise in software and hardware implementation, as well as side-channel attacks and countermeasures. Readers receive the theoretical fundamentals as an underpinning for a wealth of practical and accessible knowledge about efficient application. Features & Benefits: * Breadth of coverage and unified, integrated approach to elliptic curve cryptosystems * Describes important industry and government protocols, such as the FIPS 186-2 standard from the U.S. National Institute for Standards and Technology * Provides full exposition on techniques for efficiently implementing finite-field and elliptic curve arithmetic * Distills complex mathematics and algorithms for easy understanding * Includes useful literature references, a list of algorithms, and appendices on sample parameters, ECC standards, and software tools This comprehensive, highly focused reference is a useful and indispensable resource for practitioners, professionals, or researchers in computer science, computer engineering, network design, and network data security.
Adam Young, Moti Yung
Hackers have uncovered the dark side of cryptography—that device developed to defeat Trojan horses, viruses, password theft, and other cyber-crime. It’s called cryptovirology, the art of turning the very methods designed to protect your data into a means of subverting it. In this fascinating, disturbing volume, the experts who first identified cryptovirology show you exactly what you’re up against and how to fight back. They will take you inside the brilliant and devious mind of a hacker—as much an addict as the vacant-eyed denizen of the crackhouse—so you can feel the rush and recognize your opponent’s power. Then, they will arm you for the counterattack. This book reads like a futuristic fantasy, but be assured, the threat is ominously real. Vigilance is essential, now. Understand the mechanics of computationally secure information stealing Learn how non-zero sum Game Theory is used to develop survivable malware Discover how hackers use public key cryptography to mount extortion attacks Recognize and combat the danger of kleptographic attacks on smart-card devices Build a strong arsenal against a cryptovirology attack
As an instructor at the University of Tulsa, Christopher Swenson could find no relevant text for teaching modern cryptanalysis?so he wrote his own. This is the first book that brings the study of cryptanalysis into the 21st century. Swenson provides a foundation in traditional cryptanalysis, examines ciphers based on number theory, explores block ciphers, and teaches the basis of all modern cryptanalysis: linear and differential cryptanalysis. This time-honored weapon of warfare has become a key piece of artillery in the battle for information security.
Appropriate for all graduate-level and advanced undergraduate courses in cryptography and related mathematical fields. Modern Cryptography is an indispensable resource for every advanced student of cryptography who intends to implement strong security in real-world applications. Leading HP security expert Wenbo Mao explains why conventional crypto schemes, protocols, and systems are profoundly vulnerable, introducing both fundamental theory and real-world attacks. Next, he shows how to implement crypto systems that are truly fit for application, and formally demonstrate their fitness. He begins by reviewing the foundations of cryptography: probability, information theory, computational complexity, number theory, algebraic techniques, and more. He presents the ideal principles of authentication, comparing them with real-world implementation. Mao assesses the strength of IPSec, IKE, SSH, SSL, TLS, Kerberos, and other standards, and offers practical guidance on designing stronger crypto schemes and using formal methods to prove their security and efficiency.Finally, he presents an in-depth introduction to zero-knowledge protocols: their characteristics, development, arguments, and proofs. Mao relies on practical examples throughout, and provides all the mathematical background students will need.
Douglas R. Stinson
THE LEGACY... First introduced in 1995, Cryptography: Theory and Practice garnered enormous praise and popularity, and soon became the standard textbook for cryptography courses around the world. The second edition was equally embraced, and enjoys status as a perennial bestseller. Now in its third edition, this authoritative text continues to provide a solid foundation for future breakthroughs in cryptography. WHY A THIRD EDITION? The art and science of cryptography has been evolving for thousands of years. Now, with unprecedented amounts of information circling the globe, we must be prepared to face new threats and employ new encryption schemes on an ongoing basis. This edition updates relevant chapters with the latest advances and includes seven additional chapters covering: Pseudorandom bit generation in cryptography Entity authentication, including schemes built from primitives and special purpose "zero-knowledge" schemes Key establishment including key distribution and protocols for key agreement, both with a greater emphasis on security models and proofs Public key infrastructure, including identity-based cryptography Secret sharing schemes Multicast security, including broadcast encryption and copyright protection THE RESULT... Providing mathematical background in a "just-in-time" fashion, informal descriptions of cryptosystems along with more precise pseudocode, and a host of numerical examples and exercises, Cryptography: Theory and Practice, Third Edition offers comprehensive, in-depth treatment of the methods and protocols that are vital to safeguarding the mind-boggling amount of information circulating around the world.