4 ms·

What's a good resource to learn about crypto? I'm using the java.security and javax.crypto implementations, definitely not implementing algorithms on my own.

• wolf550e 12y ago
  http://cryptopals.com/ http://cryptopals.com/
• minthd 12y ago
  Often i see recommendations for NaCl(and maybe curveCP) as simple robust way to do crypt by non experts.
• bostik 12y ago
  For a good kickstart on the topic, Applied Cryptography. (Yes yes yes, I know, much of the technical recommendations are outdated.) It's still a damn good primer on the field itself. Then follow up with something like Handbook of Applied Cryptography. [0] It's a beast. And to top it off with something recently modern, I'd go with Cryptography Engineering. [1] After understanding the material from the earlier readings, this book is a suitably humbling experience. There are many subtle error paths and attack vectors in applied cryptography, and this book brings a few of them on, one by one. 0: http://cacr.uwaterloo.ca/hac/ http://cacr.uwaterloo.ca/hac/ 1: https://www.schneier.com/book-ce.html https://www.schneier.com/book-ce.html
  • sillysaurus3 12y ago
    Tptacek said it's a bad idea to read Applied Cryptography. "Take that book Applied Cryptography that's on your bookshelf and burn it. Do that as a commitment to really learning crypto. But absolutely don't read it. If you don't read it, you have nothing to unlearn, so you're much better off." Source: http://wiki.securityweekly.com/wiki/index.php/Episode292 http://wiki.securityweekly.com/wiki/index.php/Episode292 time index 22:10, but the whole podcast is good. Instead, he recommends Cryptography Engineering: http://www.amazon.com/Cryptography-Engineering-Principles-Practical-Applications/dp/0470474246 http://www.amazon.com/Cryptography-Engineering-Principles-Pr... Another way to get a primer on crypto is to do the Matasano crypto challenges: http://cryptopals.com/ http://cryptopals.com/ The solutions aren't (yet?) published, but don't let that stop you. It will be fairly obvious when you've come up with a solution that solves the challenge. It's also an excellent way to get you really thinking about all of the problems with crypto. And it will hopefully scare you from ever implementing your own crypto scheme, which is always a good thing. Make sure to do all the challenges though. They get exponentially more difficult, but the best ones are near the end.
    • tptacek 12y ago
      This came up often enough that I wrote a blog post about it: http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ http://sockpuppet.org/blog/2013/07/22/applied-practical-cryp...
    • bostik 12y ago
      > Instead, [tptacek] recommends Cryptography Engineering* So do I, by the way - CE is a modern book and it shows just how hard it really is to build a secure protocol. But it assumes a certain baseline background. AC is old. I do not dispute that. But as to why certain types of constructs are used, it's still a properly readable book. And quite true, the threat models in AC do not account for active attackers who are flipping bits to do real-time differential cryptanalysis. When the book was written, "data at rest" was the most common problem. If there is an equally readable, modern book which explains the whys of the constructs, I'd love to know. CE is a great book once you understand the basics - but IMO it's not really fit for a first pass.
• nly 12y ago
  Imho the best way to learn some crypto is learn the fundamental building blocks and then go and study already broken protocols and implementations. That should be enough to scare you in to the "assume everything I do is wrong and broken until proven otherwise" mindset (which could be a healthy mindset for programming in general imho) Do not just go and learn the best current practices, because those aren't going to stand the tests of time.
• JabavuAdams 12y ago
  The next iteration of Stanford's Coursera Cryptography 1 course starts on Jan 5: https://www.coursera.org/course/crypto https://www.coursera.org/course/crypto