> Instead, [tptacek] recommends Cryptography Engineering* So do I, by the way - CE is a modern book and it shows just how hard it really is to build a secure

> Instead, [tptacek] recommends Cryptography Engineering* So do I, by the way - CE is a modern book and it shows just how hard it really is to build a secure protocol. But it assumes a certain baseline background. AC is old. I do not dispute that. But as to why certain types of constructs are used, it's still a properly readable book. And quite true, the threat models in AC do not account for active attackers who are flipping bits to do real-time differential cryptanalysis. When the book was written, "data at rest" was the most common problem. If there is an equally readable, modern book which explains the whys of the constructs, I'd love to know. CE is a great book once you understand the basics - but IMO it's not really fit for a first pass.