Bruce Schneier – Applied Cryptography
The link
What it is
Applied Cryptography, colloquially known as “the big red
book”, is a manual on digital cryptography written by Bruce Schneier. It was
published in 1994, and quickly became the reference bible for all things
cryptography. The section on protocols is particularly good, and is still
relevant today.
In addition
to writing on cryptography and security, Schneier founded Counterpane Internet
Security, (now known as “BT Managed Security Solutions” after its sale to BT
Group). He is a board member at the Electronic Frontier Foundation, a
non-profit organisation which defends civil liberties and privacy on the
internet.
All things
Schneier, including blogging, can be found at www.schneier.com
What it means to me
Applied Cryptography opens with a quote: “There
are two sorts of cryptography: one kind protects you against your little sister,
the other protects you against your government”. Most people have dabbled with
cryptography somewhat: passing ‘secret code’ notes to friends in school,
protecting their diaries, or solving coded word puzzles. This is all ‘little
sister’ territory.
When you
want to build security to protect big, important things in a word teeming with plenty
of computing power and characters of dubious morality (such as Russian
mobsters and/or the American government, depending on your perspective), things
get really complicated really fast.
Applied Cryptography is a guide to the practicalities of
secret communication in a digital world. It discusses cryptographic algorithms
(ways to encipher a message), protocols (ways to distribute messages and safeguard
communications channels), and best practices in a dense but surprisingly witty
style.
The book
emphasises that it’s not just (‘mathematically’) strong cryptography that
matters, it’s what you do with it and how you implement it. The first few
chapters assume that we already have a “perfect” secret code (spoiler: we
don’t), and try to use this algorithm to build a safe communication protocol;
a series of messages that ensure secret communication between two people. The
assumption is that these people may not yet have met in person, and only have
public channels to communicate on. In fact, they each need to ascertain the
identity of the other person! This process turns out to be surprisingly difficult; in fact one of the surprising insights of the this book is that
cryptographic math is very hard, and yet it’s probably the strongest part of
the broader security system.
The book
then dives into various kinds of algorithms, and their strengths and weaknesses.
This part of the book is really technical (I still haven’t read it completely),
and is most useful as a reference.
Until I
read this book, I never considered just how much come into play with making a
networked system (such as your online banking) secure. Its thorough analysis of
common mistakes once helped me write a lengthy security violation report to a
client – after I had acquired more than 10% of the active passwords in his system.
If you’re
interested in the technology behind online banking, Virtual Private Networks
and Bitcoin, to name just a few applications, Applied Cryptography is an invaluable reference guide.
No comments:
Post a Comment