Applied Cryptography: Protocols, Algorithms, and Source Code in C, 2nd Edition

Издательство John Wiley, 1996, -1027 pp. There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files. This book is about the latter. If I take a letter, lock it in a safe, hide the safe somewhere in New York, then tell you to read the letter, that’s not security. That’s obscurity. On the other hand, if I take a letter and lock it in a safe, and then give you the safe along with the design specifications of the safe and a hundred identical safes with their combinations so that you and the world’s best safecrackers can study the locking mechanism—and you still can’t open the safe and read the letter—that’s security. For many years, this sort of cryptography was the exclusive domain of the military. The United States’ National Security Agency (NSA), and its counterparts in the former Soviet Union, England, France, Israel, and elsewhere, have spent billions of dollars in the very serious game of securing their own communications while trying to break everyone else’s. Private individuals, with far less expertise and budget, have been powerless to protect their own privacy against these governments. During the last 20 years, public academic research in cryptography has exploded. While classical cryptography has been long used by ordinary citizens, computer cryptography was the exclusive domain of the world’s militaries since World War II. Today, state–of–the–art computer cryptography is practiced outside the secured walls of the military agencies. The layperson can now employ security practices that can protect against the most powerful of adversaries—security that may protect against military agencies for years to come. Do average people really need this kind of security? Yes. They may be planning a political campaign, discussing taxes, or having an illicit affair. They may be designing a new product, discussing a marketing strategy, or planning a hostile business takeover. Or they may be living in a country that does not respect the rights of privacy of its citizens. They may be doing something that they feel shouldn’t be illegal, but is. For whatever reason, the data and communications are personal, private, and no one else’s business. This book is being published in a tumultuous time. In 1994, the Clinton administration approved the Escrowed Encryption Standard (including the Clipper chip and Fortezza card) and signed the Digital Telephony bill into law. Both of these initiatives try to ensure the government’s ability to conduct electronic surveillance. Some dangerously Orwellian assumptions are at work here: that the government has the right to listen to private communications, and that there is something wrong with a private citizen trying to keep a secret from the government. Law enforcement has always been able to conduct court–authorized surveillance if possible, but this is the first time that the people have been forced to take active measures to make themselves available for surveillance. These initiatives are not simply government proposals in some obscure area; they are preemptive and unilateral attempts to usurp powers that previously belonged to the people. Clipper and Digital Telephony do not protect privacy; they force individuals to unconditionally trust that the government will respect their privacy. The same law enforcement authorities who illegally tapped Martin Luther King Jr.’s phones can easily tap a phone protected with Clipper. In the recent past, local police authorities have either been charged criminally or sued civilly in numerous jurisdictions—Maryland, Connecticut, Vermont, Georgia, Missouri, and Nevada—for conducting illegal wiretaps. It’s a poor idea to deploy a technology that could some day facilitate a police state. The lesson here is that it is insufficient to protect ourselves with laws; we need to protect ourselves with mathematics. Encryption is too important to be left solely to governments. This book gives you the tools you need to protect your own privacy; cryptography products may be declared illegal, but the information will never be. Foundations Part I—Cryptographic Protocols Protocol Building Blocks Basic Protocols Intermediate Protocols Advanced Protocols Esoteric Protocols Part II—Cryptographic Techniques Key Length Key Management Algorithm Types and Modes Using Algorithms Part III—Cryptographic Algorithms Mathematical Background Data Encryption Standard (DES) Other Block Ciphers Still Other Block Ciphers Combining Block Ciphers Pseudo-Random-Sequence Generators and Stream Ciphers Other Stream Ciphers and Real Random-Sequence Generators One-Way Hash Functions Public-Key Algorithms Public-Key Digital Signature Algorithms Identification Schemes Key-Exchange Algorithms Special Algorithms for Protocols Part IV—The Real World Example Implementations Politics Part V—Source Code This New Edition Of The Cryptography Classic Provides You With A Comprehensive Survey Of Modern Cryptography. The Book Details How Programmers And Electronic Communications Professionals Can Use Cryptography - The Technique Of Enciphering And Deciphering Messages - To Maintain The Privacy Of Computer Data. It Describes Dozens Of Cryptography Algorithms, Gives Practical Advice On How To Implement Them Into Cryptographic Software, And Shows How They Can Be Used To Solve Security Problems. Covering The Latest Developments In Practical Cryptographic Techniques, This New Edition Shows Programmers Who Design Computer Applications, Networks, And Storage Systems How They Can Build Security Into Their Software And Systems. -- From Back Cover. Foreword / Whitfield Diffie -- 1. Foundations -- 2. Protocol Building Blocks -- 3. Basic Protocols -- 4. Intermediate Protocols -- 5. Advanced Protocols -- 6. Esoteric Protocols -- 7. Key Length -- 8. Key Management -- 9. Algorithm Types And Modes -- 10. Using Algorithms -- 11. Mathematical Background -- 12. Data Encryption Standard (des) -- 13. Other Block Ciphers -- 14. Still Other Block Ciphers -- 15. Combining Block Ciphers -- 16. Pseudo-random-sequence Generators And Stream Ciphers -- 17. Other Stream Ciphers And Real Random-sequence Generators -- 18. One-way Hash Functions -- 19. Public-key Algorithms -- 20. Public-key Digital Signature Algorithms -- 21. Identification Schemes -- 22. Key-exchange Algorithms -- 23. Special Algorithms For Protocols -- 24. Example Implementations -- 25. Politics -- Afterword / Matt Blaze. Bruce Schneier. Includes Bibliographical References (p. 675-741) And Index. ". . .The best introduction to cryptography I've ever seen. . . . The book the National Security Agency wanted never to be published. . . ." -Wired Magazine ". . .monumental . . . fascinating . . . comprehensive . . . the definitive work on cryptography for computer programmers . . ." -Dr. Dobb's Journal ". . .easily ranks as one of the most authoritative in its field." -PC Magazine ". . .the bible of code hackers." -The Millennium Whole Earth Catalog This new edition of the cryptography classic provides you with a comprehensive survey of modern cryptography. The book details how programmers and electronic communications professionals can use cryptography-the technique of enciphering and deciphering messages-to maintain the privacy of computer data. It describes dozens of cryptography algorithms, gives practical advice on how to implement them into cryptographic software, and shows how they can be used to solve security problems. Covering the latest developments in practical cryptographic techniques, this new edition shows programmers who design computer applications, networks, and storage systems how they can build security into their software and systems. What's new in the Second Edition? New information on the Clipper Chip, including ways to defeat the key escrow mechanism New encryption algorithms, including algorithms from the former Soviet Union and South Africa, and the RC4 stream cipher The latest protocols for digital signatures, authentication, secure elections, digital cash, and more More detailed information on key management and cryptographic implementations