Cryptography Decrypted

by ;
Edition: 1st
Format: Paperback
Pub. Date: 2000-12-21
Publisher(s): Addison-Wesley Professional
  • Free Shipping Icon

    Free Shipping on all Orders Over $35!*

    *excludes Marketplace items.

List Price: $54.99

Buy New

Usually Ships in 2-3 Business Days
$53.34

Buy Used

Usually Ships in 24-48 Hours
$39.59

Rent Book

Select for Price
There was a problem. Please try again later.

eBook

We're Sorry
Not Available

This item is being sold by an Individual Seller and will not ship from the Online Bookstore's warehouse. The Seller must confirm the order within two business days. If the Seller refuses to sell or fails to confirm within this time frame, then the order is cancelled.

Please be sure to read the Description offered by the Seller.

Summary

A Tool for Everyone

In the past, cryptography was used mainly to secure the communications of the powerful and influential, the military and royalty. But the widespread use of computers, and the attacks to which they are vulnerable, has expanded the need for secure communications around the globe. This book describes the protection afforded by modern computer cryptographic systems and explains how the pace of modern technology requires continuing attention to the security of those systems.

The advent of computers changed a great many things, but not the fundamentals of cryptography. Through stories and pictures, Cryptography Decrypted presents cryptography's evolution into a modern-day science, laying out patterns from the past that are applicable today. It also gives you a thorough understanding of terms that are destined to become as much a part of our language and life as megabyte and Internet. As you begin to think about controlling various aspects of your life using wired or wireless communication, on line all the time, your understanding of cryptography--its benefits and its pitfalls--will make you feel a little more in control of a rapidly changing world.

Because rapid advances in the speed of hardware will continue to threaten the security of current cryptographic methods, it's essential that you choose appropriate techniques and perform ongoing assessment if you want to maintain your digital security. You can make such choices and assessments only if you know the basic concepts of cryptography. Cryptography Decrypted offers you that knowledge through visual representation of difficult concepts, an easy-to-use reference for reviewing key cryptographic terminology, and instructive historical information.

You need little or no background in cryptography to read this book. Neither does it require technical or math genius. It's designed so that anyone from CIOs to self-taught computer enthusiasts--and everyone in between--can pick up this book without any knowledge of encryption and find it fascinating, understandable, and instructive.

If you have some understanding of computer cryptography, Cryptography Decrypted is systematic and comprehensive enough to solidify your knowledge. It provides a simple description of the component parts of secret key and public key cryptography. (Those who already understand and don't wish to cover any more material about secret key cryptography may choose to read only Parts II through IV, bypassing Part I.)

Throughout the book, we use images to clarify cryptographic terms. After explaining the basic cryptographic components, we describe real-world cryptographic systems, some possible attacks on those systems, and ways to protect your keys.

The book provides a historical framework on which to build your understanding of how and why computer cryptography works. After a discussion of how cryptography has evolved into an essential Internet tool, we analyze secret key exchange problems and then explain the evolution of public key cryptography, with its solution to the key exchange problem. Along the way we explain some simple background on the math tricks that make public key cryptography secure. Traditionally, those who have thoroughly understood cryptography have been trained as mathematicians or scientists. Our goal here is to explain computer cryptography with rather little discussion of math. If the esoteric details aren't of immediate concern to you, you can skip Chapter 11 ("Making Public Keys: Math Tricks"), Chapter 14 ("Message Digest Assurances"), and the appendixes without diminishing your understanding of the basic concepts. Appendix A describes some aspects of public key mathematics, including inverses, primes, the Fermat test, Diffie-Hellman, DSA, elliptic curve, and pseudo-random number generation. Appendix B provides details of IPsec, a security system introduced in Chapter 21.



0201616475P04062001

Author Biography

H.X. Mel consults and develops computer systems for organizations such as Lucent, Xerox, MIT, the U.S. Government, Motorola, Goldman Sachs, and PricewaterhouseCoopers. Doris Baker is a freelance technical writer and editor.

0201616475AB04062001

Table of Contents

Foreword xv
Preface xvii
Introduction xix
Part I Secret Key Cryptography 1(74)
Locks and Keys
3(4)
Locks and Combinations
3(2)
Defining Cryptographic Terms
5(1)
Making and Solving Puzzles
6(1)
Review
6(1)
Substitution and Caesar's Cipher
7(14)
Cryptanalysis of Caesar's Cipher
10(1)
Empowering the Masses
11(1)
The Importance of Separating the Method and the Key
12(1)
Adding Keys
13(2)
A Weakness of Caesar's Ciphers: The Failure to Hide Linguistic Patterns
14(1)
More Complex Substitution: Vigenere's Cipher
15(4)
Review
19(2)
Transposition Ciphers: Moving Around
21(8)
Patterns and Cryptanalysis
22(1)
Adding Complexity
23(2)
Computer Transposition
25(1)
Combining Substitution and Transposition
26(2)
Review
28(1)
Diffuse and Confuse: How Cryptographers Win the End Game
29(8)
Diffusion
29(4)
The Polybius Cipher
30(3)
The Principle of Confusion
33(1)
Cryptographic Locks and Keys
34(1)
Review
35(2)
DES Isn't Strong Anymore
37(8)
The Historical Need for an Encryption Standard
37(3)
Cycling Through Computer Keys
40(1)
Double and Triple DES
41(1)
DES (and Other Block Cipher) Modes
42(1)
The Avalanche Effect
42(1)
Supplement: Binary Numbers and Computer Letters
43(1)
Review
44(1)
Evolution of Cryptography: Going Global
45(8)
Early Cryptography
46(2)
Commercial and Military Needs
48(1)
Entering the Computer Age
49(2)
Review
51(2)
Secret Key Assurances
53(12)
Confidentiality
54(1)
Authentication
55(2)
An Authentication Attack
57(1)
Not Really Random Numbers
57(2)
Integrity
59(4)
Using the MAC for Message Integrity Assurance
60(2)
Why Bother Using a Message Authentication Code?
62(1)
File and MAC Compression
62(1)
Nonrepudiation: Secret Keys Can't Do It
63(1)
Review
64(1)
Problems with Secret Key Exchange
65(10)
The Problem and the Traditional Solution
66(2)
Using a Trusted Third Party
68(2)
Key Distribution Center and Key Recovery
70(1)
Problems with Using a Trusted Third Party
71(1)
Growth in the Number of Secret Keys
71(1)
Trust and Lifetime
72(1)
Review
72(3)
Part II Public Key Cryptography 75(88)
Pioneering Public Key: Public Exchange of Secret Keys
77(12)
The Search for an Innovative Key Delivery Solution
77(1)
Developing an Innovative Secret Key Delivery Solution
77(7)
First Attempt: A Database of Key/Serial Number Pairs
78(1)
Second Attempt: An Encrypted Database of Key/Serial Number Pairs
79(1)
Merkle's Insight: Individually Encrypted Key/Serial Number Pairs
80(1)
Black Hat's Frustrating Problem
81(1)
The Key to Public Key Technology
82(2)
A New Solution: Diffie-Hellman-Merkle Key Agreement
84(2)
Alice and Bob Openly Agree on a Secret Key
84(2)
Problems with the Diffie-Hellman Method
86(1)
Separate Encryption and Decryption Keys
86(2)
Review
88(1)
Confidentiality Using Public Keys
89(8)
New Twists on Old Security Issues
89(3)
Confidentiality Assurances
92(1)
Distribution of Public Keys
92(2)
Two-Way Confidentiality
94(1)
Review
95(2)
Making Public Keys: Math Tricks
97(18)
Alice's Easy Problem
98(2)
Grade School Math Tricks
100(1)
More Grade School Math
101(2)
Division and Remainders: Modular Math
103(3)
Modular Inverses
106(3)
Using Modular Inverses to Make a Public Key
109(1)
Putting It All Together
110(2)
Giving BlackHat a Difficult, Time-Consuming Problem
110(1)
Trapdoor to the Easy Problem
111(1)
Knapsack Cryptography
112(1)
Modulo Calculations
112(1)
Exercise: Find Which Numbers Sum to 103
112(1)
Review
113(2)
Creating Digital Signatures Using the Private Key
115(12)
Written and Digital Signature Assurances
116(1)
Reviewing and Comparing Authentication
117(2)
Secret Key Authentication
117(1)
Private Key Authentication
117(2)
Authentication and Integrity Using Private and Secret Keys
119(1)
Private Key Authentication Methods
120(2)
RSA
120(1)
DSA
121(1)
Signing Terminology
122(1)
Nonrepudiation
122(1)
Assurances in Both Directions
123(1)
Summary of Public Key Assurances
123(1)
Public Key Means Public/Private Key
124(1)
Assurance Initiated
124(1)
Compressing before Signing
124(1)
Review
125(2)
Hashes: Non-keyed Message Digests
127(14)
Detecting Unintentional Modifications
129(2)
Detecting Intentional Modifications
131(2)
Signing the Message Digest
133(3)
Detecting BlackHat's Forgery
135(1)
Replay Attacks
136(1)
Supplement: Unsuccessfully Imitating a Message Digest
137(1)
Review
138(3)
Message Digest Assurances
141(16)
Two Message Digest Flavors
141(2)
Non-keyed Message Digest Assurances
143(7)
One-wayness
143(1)
Collision Resistance
143(1)
Weak Collision Resistance
144(1)
Examples of One-way and Weak Collision Resistance
145(2)
Strong Collision Resistance
147(3)
Non-keyed Digest Implementations
150(1)
Keyed Message Digest Assurances
151(3)
A MAC Made with DES
151(1)
DES-MAC Security
152(2)
Message Digest Compression
154(1)
Digest Speed Comparisons
155(1)
Hashed MAC
155(1)
Review
156(1)
Comparing Secret Key, Public Key, and Message Digests
157(6)
Encryption Speed
157(1)
Key Length
158(1)
Ease of Key Distribution
158(1)
Cryptographic Assurances
159(2)
Symmetric (Secret) Key
159(1)
Asymmetric (Public) Key
159(2)
Review
161(2)
Part III Distribution of Public Keys 163(40)
Digital Certificates
165(12)
Verifying a Digital Certificate
167(1)
Attacking Digital Certificates
167(2)
Attacking the Creator of the Digital Certificate
168(1)
Malicious Certificate Creator
168(1)
Attacking the Digital Certificate User
168(1)
The Most Devastating Attack
168(1)
Understanding Digital Certificates: A Familiar Comparison
169(3)
Issuer and Subject
169(1)
Issuer Authentication
169(1)
Transfer of Trust from the Issuer to the Subject
170(1)
Issuer's Limited Liability
171(1)
Time Limits
171(1)
Revoking Trust
171(1)
More than One Certificate
172(1)
Fees for Use
172(1)
The Needs of Digital Certificate Users
172(1)
Getting Your First Public Key
173(1)
Certificates Included in Your Browser
174(1)
Review
174(3)
X.509 Public Key Infrastructure
177(16)
Why Use X.509 Certificate Management?
178(1)
What Is a Certificate Authority?
179(3)
Application, Certification, and Issuance
179(2)
Certificate Revocation
181(1)
Polling and Pushing: Two CRL Delivery Models
182(1)
Building X.509 Trust Networks
182(7)
Root Certificates
183(4)
More Risks and Precautions
187(1)
Distinguished Names
188(1)
Certification Practice Statement
189(1)
X.509 Certificate Data
189(1)
Challenge Response Protocol
190(1)
Review
190(3)
Pretty Good Privacy and the Web of Trust
193(10)
The History of PGP
193(1)
Comparing X.509 and PGP Certificates
194(2)
Building Trust Networks
196(4)
Bob Validates Alice's Key
196(1)
Casey Validates Alice's Key Sent by Bob
197(1)
Dawn Validates Alice's Key Sent by Casey via Bob
198(2)
Web of Trust
200(1)
PGP Certificate Repositories and Revocation
200(1)
Compatibility of X.509 and PGP
201(1)
Review
201(2)
Part IV Real-World Systems 203(60)
E-mail Cryptographic Parameters
204(1)
Negotiation of SSL and IPsec Cryptographic Parameters
204(1)
User Initiation of Cryptographic E-mail, SSL, and IPsec
205(2)
Secure E-mail
207(8)
Generic Cryptographic E-mail Messages
207(2)
Invoking Cryptographic Services
209(2)
Confidentiality and Authentication
211(2)
Choosing Services
211(1)
Positioning Services
212(1)
Deterring E-mail Viruses
213(1)
Review
213(2)
Secure Socket Layer and Transport Layer Security
215(14)
History of SSL
216(1)
Overview of an SSL Session
216(2)
An SSL Session in Detail
218(6)
Hello and Negotiate Parameters
219(2)
Key Agreement (Exchange)
221(1)
Authentication
222(1)
Confidentiality and Integrity
223(1)
TLS Variations
224(1)
Anonymous Diffie-Hellman
224(1)
Fixed and Ephemeral Diffie-Hellman
225(1)
Comparing TLS, SSL v3, and SSL v2
225(1)
A Big Problem with SSL v2
225(1)
A Possible Problem with TLS and SSL
225(1)
Generating Shared Secrets
226(1)
Bob Authenticates Himself to AliceDotComStocks
227(1)
Review
227(2)
IPsec Overview
229(18)
Enhanced Security
229(1)
Key Management
230(2)
Manual Distribution
231(1)
Automated Distribution
231(1)
IPsec Part 1: User Authentication and Key Exchange Using IKE
232(5)
SSL/TLS and IPsec Key Agreement
232(1)
Security Association
232(1)
Phases
233(2)
IKE Nomenclature
235(1)
Benefits of Two-Phase Key Exchange
235(2)
IPsec Part 2: Bulk Data Confidentiality and Integrity for Message or File Transport
237(8)
Protocol and Mode
238(3)
ESP Examples
241(2)
AH Examples
243(1)
Management Control
244(1)
Implementation Incompatibilities and Complications
245(1)
Review
246(1)
Cryptographic Gotchas
247(12)
Replay Attack
247(1)
Man-in-the-Middle Attack
247(2)
Finding Your Keys in Memory
249(1)
Does Confidentiality Imply Integrity?
249(2)
Example 1
250(1)
Cut-and-Paste Attack
250(1)
Public Key as a Cryptanalysis Tool
251(2)
The Chosen Plaintext Attack
251(2)
Public Key Cryptographic Standards
253(1)
The Bleichenbacher Attack
253(1)
BlackHat Uses Bob's RSA Private Key
253(4)
Review
257(2)
Protecting Your Keys
259(4)
Smart Cards
259(3)
Types of Smart Cards
260(1)
What's Inside a Smart Card
261(1)
Protections and Limitations
261(1)
Smart Card Attacks
261(1)
Review
262(1)
Epilogue 263(4)
Appendix A Public Key Mathematics (and Some Words on Random Numbers) 267(54)
Appendix B (A Few) IPsec Details 321(16)
Bibliography 337(8)
Index 345

Excerpts

A Tool for Everyone In the past, cryptography was used mainly to secure the communications of the powerful and influential, the military and royalty. But the widespread use of computers, and the attacks to which they are vulnerable, has expanded the need for secure communications around the globe. This book describes the protection afforded by modern computer cryptographic systems and explains how the pace of modern technology requires continuing attention to the security of those systems. The advent of computers changed a great many things, but not the fundamentals of cryptography. Through stories and pictures,Cryptography Decryptedpresents cryptography's evolution into a modern-day science, laying out patterns from the past that are applicable today. It also gives you a thorough understanding of terms that are destined to become as much a part of our language and life asmegabyteandInternet. As you begin to think about controlling various aspects of your life using wired or wireless communication, on line all the time, your understanding of cryptography--its benefits and its pitfalls--will make you feel a little more in control of a rapidly changing world. Because rapid advances in the speed of hardware will continue to threaten the security of current cryptographic methods, it's essential that you choose appropriate techniques and perform ongoing assessment if you want to maintain your digital security. You can make such choices and assessments only if you know the basic concepts of cryptography.Cryptography Decryptedoffers you that knowledge through visual representation of difficult concepts, an easy-to-use reference for reviewing key cryptographic terminology, and instructive historical information. You need little or no background in cryptography to read this book. Neither does it require technical or math genius. It's designed so that anyone from CIOs to self-taught computer enthusiasts--and everyone in between--can pick up this book without any knowledge of encryption and find it fascinating, understandable, and instructive. If you have some understanding of computer cryptography,Cryptography Decryptedis systematic and comprehensive enough to solidify your knowledge. It provides a simple description of the component parts of secret key and public key cryptography. (Those who already understand and don't wish to cover any more material about secret key cryptography may choose to read only Parts II through IV, bypassing Part I.) Throughout the book, we use images to clarify cryptographic terms. After explaining the basic cryptographic components, we describe real-world cryptographic systems, some possible attacks on those systems, and ways to protect your keys. The book provides a historical framework on which to build your understanding of how and why computer cryptography works. After a discussion of how cryptography has evolved into an essential Internet tool, we analyze secret key exchange problems and then explain the evolution of public key cryptography, with its solution to the key exchange problem. Along the way we explain some simple background on the math tricks that make public key cryptography secure. Traditionally, those who have thoroughly understood cryptography have been trained as mathematicians or scientists. Our goal here is to explain computer cryptography with rather little discussion of math. If the esoteric details aren't of immediate concern to you, you can skip Chapter 11 ("Making Public Keys: Math Tricks"), Chapter 14 ("Message Digest Assurances"), and the appendixes without diminishing your understanding of the basic concepts. Appendix A describes some aspects of public key mathematics, including inverses, primes, the Fermat test, Diffie-Hellman, DSA, elliptic curve, and pseudo-random number generation. Appendix B provides details of IPsec, a security system introduced in Chapter 21. 0201616475P040620

An electronic version of this book is available through VitalSource.

This book is viewable on PC, Mac, iPhone, iPad, iPod Touch, and most smartphones.

By purchasing, you will be able to view this book online, as well as download it, for the chosen number of days.

A downloadable version of this book is available through the eCampus Reader or compatible Adobe readers.

Applications are available on iOS, Android, PC, Mac, and Windows Mobile platforms.

Please view the compatibility matrix prior to purchase.