Schneier on Security

• Preface
• How to Read this Book
• 1 Our Design Philosophy
• 1.1 The Evils of Performance
• 1.2 The Evils of Features
• 2 The Context of Cryptography
• 2.1 The Role of Cryptography
• 2.2 The Weakest Link Property
• 2.3 The Adversarial Setting
• 2.4 Practical Paranoia
• 2.4.1 Attack
• 2.5 Threat Model
• 2.6 Cryptography Is Not the Solution
• 2.7 Cryptography Is Very Difficult
• 2.8 Cryptography Is the Easy Part
• 2.9 Background Reading
• 3 Introduction to Cryptography
• 3.1 Encryption
• 3.1.1 Kerckhoffs’ Principle
• 3.2 Authentication
• 3.3 Public-Key Encryption
• 3.4 Digital Signatures…

In the past decade, cryptography has done more to damage the security of digital systems than it has to enhance it. Cryptography burst onto the world stage in the early 1990s as the securer of the Internet. Some saw cryptography as a great technological equalizer, a mathematical tool that would put the lowliest privacy-seeking individual on the same footing as the greatest national intelligence agencies. Some saw it as the weapon that would bring about the downfall of nations when governments lost the ability to police people in cyberspace. Others saw it as the perfect and terrifying tool of drug dealers, terrorists, and child pornographers, who would be able to communicate in perfect secrecy. Even those with more realistic attitudes imagined cryptography as a technology that would enable global commerce in this new on-line world…

Practical Cryptography

A book by Niels Ferguson and Bruce Schneier

The second edition of this book has been renamed Cryptography Engineering.

This book is about cryptography as it is used in real-world systems, about cryptography as an engineering discipline rather than cryptography as a mathematical science.

Building real-world cryptographic systems is vastly different from the abstract world of most books on cryptography, which discuss a pure mathematical ideal that magically solves your security problems. Designers and implementors live in a very different world, where nothing is perfect and where experience shows that most cryptographic systems are broken due to problems that have nothing to do with mathematics. This book is about how to apply the cryptographic functions in a real-world setting in such a way that you actually get a secure system…