5 ms·

If you are interested in details of the TLS protocol, check out these two books: - Implementing SSL / TLS Using Cryptography and PKI [1] - Bulletproof SSL and

If you are interested in details of the TLS protocol, check out these two books: - Implementing SSL / TLS Using Cryptography and PKI [1] - Bulletproof SSL and TLS: Understanding and Deploying SSL/TLS and PKI to Secure Servers and Web Applications [2] In the first one the author implements the protocol (RSA/DH) from scratch (without even using any crypto library). The second one is a classic and contains a lot of interesting scripts (the chapter on using OpenSSL and creating your own PKI is available for free: https://www.feistyduck.com/books/openssl-cookbook/ https://www.feistyduck.com/books/openssl-cookbook/). I spent some time studying TLS and wrote two blog posts [3][4], in which I decrypt the network traces of the TLS sessions. Maybe someone will find them interesting too. [1] https://www.amazon.com/Implementing-SSL-TLS-Using-Cryptography/dp/0470920416 https://www.amazon.com/Implementing-SSL-TLS-Using-Cryptograp... [2] https://www.amazon.com/gp/product/1907117040 https://www.amazon.com/gp/product/1907117040 [3] https://lowleveldesign.org/2016/03/09/manually-decrypting-https-request/ https://lowleveldesign.org/2016/03/09/manually-decrypting-ht... [4] https://lowleveldesign.org/2016/05/10/tls-1-2-aes-gcm-and-net-network-trace/ https://lowleveldesign.org/2016/05/10/tls-1-2-aes-gcm-and-ne...

dotancohen 9y ago
I haven't read the books, and I'm sure that they are fascinating, but I am wary of any attempt to home-brew crypto. I'm specifically worried that some corner-cutters might use the Implementing SSL book's code or ideas in production.
- lowleveldesign 9y ago
  I'm also against home-brew crypto, but the author clearly states that what he presents has only educational purpose. It's a bit like cryptopals - you also implement your own crypto in order to learn something.
- farax91 9y ago
  I don't think that's the point of the book. There is enormous benefit that can be gleaned from building a "workable" implementation from first principles, even if it's not actually production "workable". These types of books are rare and very challenging to write, will definitely be taking a look.
- marklgr 9y ago
  What's the alternative, lock all books related to cryptography lest someone might do something in production? Educating is fine, and people reading relatively advanced technical books like this one should be considered as responsible, I think.
  - pampa 9y ago
    Not only reasonable, but it is a must. I think the "don't roll your own crypto" phrase is widely misunderstood. A better phrase would be - learn as much about crypto as you possibly can, to clearly understand why it is a bad idea to roll your own in production. This also means that after you learn it, you will have a much better idea which library, cypher or mode to pick for a particular task, and not just think "oh, crypto is complicated, i will just wrap everything in TLS and won't bother to check the certs"
    - djsumdog 9y ago
      People who are wanting to get into complex cryptography today have to start somewhere. Showing working models, with huge disclaimers, in blog posts and on github is a great way to lean, if you invite others to show you flaws and break your implementation.
      - tptacek 9y ago
        If you want to build complex cryptography, you must either obtain formal training, or learn how to break complex cryptography. What you can't do is read a book or two about cryptography, the way you would a new programming language, and then bootstrap your own expertise from that. Cryptography is a lot trickier than most other topics in computer science.
        Kubuxu 9y ago
        There is enormous difference between rolling your own crypto primitives and using existing primitives to create a protocol.
- snakeanus 9y ago
  It's not "home-brew crypto" if it is a well established protocol.
  - schoen 9y ago
    Nonetheless, even an implementation of a well-established protocol could have problems like a timing attack or an oracle attack, so it's worth being extremely careful.
- ianai 9y ago
  So a book that teaches a programming language with a "toy" software project does more harm than good? This is industry standard stuff.
ianai 9y ago
Thank you so much for those book suggestions. They will either be exactly what I wanted to know or a great reference down the road.

dotancohen 9y ago

I haven't read the books, and I'm sure that they are fascinating, but I am wary of any attempt to home-brew crypto. I'm specifically worried that some corner-cutters might use the Implementing SSL book's code or ideas in production.

lowleveldesign 9y ago
I'm also against home-brew crypto, but the author clearly states that what he presents has only educational purpose. It's a bit like cryptopals - you also implement your own crypto in order to learn something.
farax91 9y ago
I don't think that's the point of the book. There is enormous benefit that can be gleaned from building a "workable" implementation from first principles, even if it's not actually production "workable". These types of books are rare and very challenging to write, will definitely be taking a look.
marklgr 9y ago
What's the alternative, lock all books related to cryptography lest someone might do something in production? Educating is fine, and people reading relatively advanced technical books like this one should be considered as responsible, I think.
- pampa 9y ago
  Not only reasonable, but it is a must. I think the "don't roll your own crypto" phrase is widely misunderstood. A better phrase would be - learn as much about crypto as you possibly can, to clearly understand why it is a bad idea to roll your own in production. This also means that after you learn it, you will have a much better idea which library, cypher or mode to pick for a particular task, and not just think "oh, crypto is complicated, i will just wrap everything in TLS and won't bother to check the certs"
  - djsumdog 9y ago
    People who are wanting to get into complex cryptography today have to start somewhere. Showing working models, with huge disclaimers, in blog posts and on github is a great way to lean, if you invite others to show you flaws and break your implementation.
    - tptacek 9y ago
      If you want to build complex cryptography, you must either obtain formal training, or learn how to break complex cryptography. What you can't do is read a book or two about cryptography, the way you would a new programming language, and then bootstrap your own expertise from that. Cryptography is a lot trickier than most other topics in computer science.
      - Kubuxu 9y ago
        There is enormous difference between rolling your own crypto primitives and using existing primitives to create a protocol.
snakeanus 9y ago
It's not "home-brew crypto" if it is a well established protocol.
- schoen 9y ago
  Nonetheless, even an implementation of a well-established protocol could have problems like a timing attack or an oracle attack, so it's worth being extremely careful.
ianai 9y ago
So a book that teaches a programming language with a "toy" software project does more harm than good? This is industry standard stuff.

ianai 9y ago

Thank you so much for those book suggestions. They will either be exactly what I wanted to know or a great reference down the road.