5 ms·

This is old cryptography. This book should not be quite as bad for its readers as Schneier's Applied Cryptography (which includes many ciphers which were known

This is old cryptography. This book should not be quite as bad for its readers as Schneier's Applied Cryptography (which includes many ciphers which were known to be broken at the time, with little hint of that fact in the text), but it's still old-fashioned. E.g. - Chapter 7 "block ciphers" doesn't even mention CTR mode, but does mention CFB and OFB. Modern cryptosystems all use CTR mode, and no new system I'm aware of uses CFB or OFB. - Chapter 8 "Public-Key Encryption" doesn't even mention elliptic-curve cryptography, despite almost all new cryptosystems being based on that in some form or another. This chapter also doesn't appear to mention RSA padding, which is crucial to a secure RSA implementation. - Chapter 9 "Hash Functions and Data Integrity" doesn't mention anything newer than SHA-1. But SHA-1 is thoroughly deprecated, and will be broken in the next few years. Just buy a new book instead; I hear good things about Cryptography Engineering, and I liked "An Introduction to Modern Cryptography" (more mathematical, less engineering-focused).

pieter_mj 10y ago
> But SHA-1 is thoroughly deprecated, and will be broken in the next few years. Why is this a problem? sha1 is not broken by design, it's only broken by current and future computing power.
- taejo 10y ago
  No, SHA-1's design is broken. The attacks still need a lot of computing power, but much less than they would if SHA-1 was secure.
- geofft 10y ago
  That's not true. SHA-1 is a 160-bit hash, which means that you'd expect it to take on average 2^80 hash computations to find a collision. The best attacks against full SHA-1 require more like 2^57 to 2^61 computations, and there are attacks against parts of SHA-1 that require quite a bit less than that (which indicates that the design is risky). https://en.wikipedia.org/wiki/SHA-1#Cryptanalysis_and_validation https://en.wikipedia.org/wiki/SHA-1#Cryptanalysis_and_valida... The difference between 2^60 and 2^80 is huge. If 2^80 operations take, say, a thousand years, it would take only about 8 hours to do 2^60 operations. (Also, there's the additional twist that SHA-1 isn't even the fastest known algorithm. If you switch to BLAKE2, you can get faster hashing, and the output is 256-bit, so the brute-force strength is 2^128, which more than makes up for each individual operation being a little faster. https://blake2.net/ https://blake2.net/)
geofft 10y ago
Another free and more up-to-date option is http://www.crypto101.io/ http://www.crypto101.io/ , but significant parts of the book are still in progress.
egjerlow 10y ago
What about the updated Cryptography engineering book by Schneier et al? Do you have any experience with it?
- nabla9 10y ago
  I think you mean: Cryptography Engineering : Design Principles and Practical Applications by Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno The book is introduction to the engineering problems and details when implementing cryptography. It introduces primitives, like symmetric ciphers, hash functions etc. and then shows how to write actual protocols using them. It covers many practical details and implementation concerns. I think it's good read. Just bear in mind that it's not comprehensive or authoritative. Some advice can be controversial. For example, they lean on authentication before encryption that others consider bad practice.
- JoachimSchipper 10y ago
  No experience, but I wrote "I hear good things about Cryptography Engineering". That said, at least one colleague was much happier with Security Engineering (also available for free online, and the non-crypto parts age well). Security Engineering doesn't teach you hard crypto (much), but does teach threat modelling and presents various solutions.
- tptacek 10y ago
  http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ http://sockpuppet.org/blog/2013/07/22/applied-practical-cryp...
  - nxzero 10y ago
    Aside from Stack Exchange, are there any other good cryptography Q&A forums: http://crypto.stackexchange.com/questions?sort=votes http://crypto.stackexchange.com/questions?sort=votes http://security.stackexchange.com/tags http://security.stackexchange.com/tags
user2994cb 10y ago
Also, section 9.6.5 advocates MAC-then-encrypt over encrypt-then-MAC - presumably the flaws in this approach have only become apparent since the book was published. An interesting historical document though.
- alister 10y ago
  > presumably the flaws in this approach have only become apparent since the book was published A nice concise discussion of Encrypt-then-MAC vs MAC-then-Encrypt can be found here: http://crypto.stackexchange.com/questions/202/should-we-mac-then-encrypt-or-encrypt-then-mac http://crypto.stackexchange.com/questions/202/should-we-mac-...

pieter_mj 10y ago

> But SHA-1 is thoroughly deprecated, and will be broken in the next few years. Why is this a problem? sha1 is not broken by design, it's only broken by current and future computing power.

taejo 10y ago
No, SHA-1's design is broken. The attacks still need a lot of computing power, but much less than they would if SHA-1 was secure.
geofft 10y ago
That's not true. SHA-1 is a 160-bit hash, which means that you'd expect it to take on average 2^80 hash computations to find a collision. The best attacks against full SHA-1 require more like 2^57 to 2^61 computations, and there are attacks against parts of SHA-1 that require quite a bit less than that (which indicates that the design is risky). https://en.wikipedia.org/wiki/SHA-1#Cryptanalysis_and_validation https://en.wikipedia.org/wiki/SHA-1#Cryptanalysis_and_valida... The difference between 2^60 and 2^80 is huge. If 2^80 operations take, say, a thousand years, it would take only about 8 hours to do 2^60 operations. (Also, there's the additional twist that SHA-1 isn't even the fastest known algorithm. If you switch to BLAKE2, you can get faster hashing, and the output is 256-bit, so the brute-force strength is 2^128, which more than makes up for each individual operation being a little faster. https://blake2.net/ https://blake2.net/)

geofft 10y ago

Another free and more up-to-date option is http://www.crypto101.io/ http://www.crypto101.io/ , but significant parts of the book are still in progress.

egjerlow 10y ago

What about the updated Cryptography engineering book by Schneier et al? Do you have any experience with it?

nabla9 10y ago
I think you mean: Cryptography Engineering : Design Principles and Practical Applications by Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno The book is introduction to the engineering problems and details when implementing cryptography. It introduces primitives, like symmetric ciphers, hash functions etc. and then shows how to write actual protocols using them. It covers many practical details and implementation concerns. I think it's good read. Just bear in mind that it's not comprehensive or authoritative. Some advice can be controversial. For example, they lean on authentication before encryption that others consider bad practice.
JoachimSchipper 10y ago
No experience, but I wrote "I hear good things about Cryptography Engineering". That said, at least one colleague was much happier with Security Engineering (also available for free online, and the non-crypto parts age well). Security Engineering doesn't teach you hard crypto (much), but does teach threat modelling and presents various solutions.
tptacek 10y ago
http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ http://sockpuppet.org/blog/2013/07/22/applied-practical-cryp...
- nxzero 10y ago
  Aside from Stack Exchange, are there any other good cryptography Q&A forums: http://crypto.stackexchange.com/questions?sort=votes http://crypto.stackexchange.com/questions?sort=votes http://security.stackexchange.com/tags http://security.stackexchange.com/tags

user2994cb 10y ago

Also, section 9.6.5 advocates MAC-then-encrypt over encrypt-then-MAC - presumably the flaws in this approach have only become apparent since the book was published. An interesting historical document though.

alister 10y ago
> presumably the flaws in this approach have only become apparent since the book was published A nice concise discussion of Encrypt-then-MAC vs MAC-then-Encrypt can be found here: http://crypto.stackexchange.com/questions/202/should-we-mac-then-encrypt-or-encrypt-then-mac http://crypto.stackexchange.com/questions/202/should-we-mac-...