Register your product to gain access to bonus material or receive a coupon.
Internet Cryptography
- By Richard E. Smith
- Published Jul 22, 1997 by Addison-Wesley Professional.
Book
- Sorry, this book is no longer in print.
Description
- Copyright 1997
- Dimensions: 7-3/8" x 9-1/4"
- Edition: 1st
- Book
- ISBN-10: 0-201-92480-3
- ISBN-13: 978-0-201-92480-0
"This book provides an excellent overview of how encryption is used, its strengths and weaknesses, and what to look for when building or choosing real-world solutions. This is a must-have book for anyone considering the deployment of an important system relying on modern cryptography."
- Marcus J. Ranum Chief Scientist, V-ONE Corporation
Here, in one comprehensive, soup-to-nuts book, is the solution for Internet security: modern-day cryptography. Written by a security expert with a wealth of practical experience, this book covers network and Internet security in terms that are easy to understand, using proven technology, systems, and solutions. From the client workstation to the Web host to the e-mail server, every aspect of this important topic is examined and explained. The once-daunting subject of cryptography is demystified and applied to today's security challenges. Topics include:
|
|
This book is written for people who want to move data safely across the Internet and protect corporate resources from unauthorized access. Using real-life case studies, examples, and commercially available software products, cryptography is presented as a practical solution to specific, everyday security challenges.
0201924803B04062001
Sample Content
Table of Contents
(NOTE: Each chapter concludes with For Further Information.)
Preface.
Who This Book Is For.
How This Book Is Organized.
Crypto Today and Tomorrow.
Comments and Questions.
Acknowledgments.
1. Introduction.
The Basic Problem.
Essentials of Crypto.
Crypto Is Hard to Use.
Balancing Crypto Use with Your Objectives.
Essentials of Networking and the Internet.
Protocol Layers and Network Products.
Internet Technology.
Internet Protocols in Your Host.
The Internet Security Problem.
An Internet Rogue's Gallery.
Setting Realistic Security Objectives.
Appropriate Communications Security.
Communications Security Goals.
Internet Crypto Techniques.
Legal Restrictions.
2. Encryption Basics.
Encryption Building Blocks.
Stream Ciphers.
Block Ciphers.
How Crypto Systems Fail.
Cryptanalysis and Modern Codes.
Brute Force Cracking of Secret Keys.
Attacks on Improper Crypto Use.
Choosing Between Strong and Weak Crypto.
Properties of Good Crypto Algorithms.
Crypto Algorithms to Consider.
Selecting a Block Cipher Mode.
Identifying a Safe Key Length.
Levels of Risk for Different Applications.
3. Link Encryption.
Security Objectives.
Product Example: In-line Encryptor.
Red/Black Separation.
Crypto Algorithm and Keying.
Encryptor Vulnerabilities.
Product Security Requirements.
Deployment Example: Point-to-Point Encryption.
Point-to-Point Practical Limitations.
Physical Protection and Control.
Deployment Security Requirements.
Deployment Example: IP-routed Configuration.
Site Protection.
Networkwide Security.
Deployment Security Requirements.
Key Recovery and Escrowed Encryption.
4. Managing Secret Keys.
Security Objectives.
Basic Issues in Secret Key Management.
Technology: Random Key Generation.
Random Seeding.
Pseudorandom Number Generators.
Technical Security Requirements.
Deployment Example: Manual Key Distribution.
Preparing Secret Keys for Delivery.
Batch Generation of Keys.
Printing Keys on Paper.
Key Packaging and Delivery.
Key Splitting for Safer Delivery.
Deployment Security Requirements.
Technology: Automatic Rekeying.
ANSI X9.17 Point-to-Point Rekeying.
Variations of X9.17.
Technical Security Requirements.
Key Distribution Centers (KDCs).
Maintaining Keys and System Security.
5. Security at the IP Layer.
Security Objectives.
Basic Issues with Using IPSEC.
Technology: Cryptographic Checksums.
One-way Hash Functions.
Technical Security Requirements.
IPSEC: IP Security Protocol.
IPSEC Authentication.
IPSEC Encryption.
IPSEC Key Management.
Other TCP/IP Network Security Protocols.
6. Virtual Private Networks.
Security Objectives.
Basic Issues with VPNs.
Technology: IPSEC Proxy Cryptography.
ESP Tunnel Mode.
ESP Transport Mode.
Product Example: IPSEC Encrypting Router.
Blocking Classic Internet Attacks.
Product Security Requirements.
Deployment Example: Site-to-Site Encryption.
Header Usage and Security.
Deployment Security Requirements.
7. Remote Access with IPSEC.
Security Objectives.
Basic Issues with IPSEC Clients.
Product Example: IPSEC Client.
Client Security Associations.
Client Self-Defense on the Internet.
Client Theft and Key Protection.
Product Security Requirements.
Deployment Example: Client-to-Server Site Access.
Remote Access Security Issues.
Deployment Security Requirements.
8. IPSEC and Firewalls.
Security Objectives.
Basic Issues with IPSEC and Firewalls.
Internet Firewalls.
What Firewalls Control.
How Firewalls Control Access.
Firewall Control Mechanisms.
Product Example: IPSEC Firewall.
Administering Multiple Sites.
Product Security Requirements.
Deployment Example: A VPN with a Firewall.
Establishing a Site Security Policy.
Chosen Plaintext Attack on a Firewall.
Deployment Security Requirements.
9. Public Key Crypto and SSL.
Public Key Cryptography.
Evolution of Public Key Crypto.
Diffie-Hellman Public Key Technique.
Brute Force Attacks on RSA.
Other RSA Vulnerabilities.
Technical Security Requirements.
Technology: Secret Key Exchange with RSA Crypto.
Attacking Public Key Distribution.
Public Key versus Secret Key Exchange.
Technical Security Requirements.
Secure Sockets Layer.
Other SSL Properties.
Basic Attacks Against SSL.
SSL Security Evolution.
10. World Wide Web Transaction Security.
Security Objectives.
Basic Issues in Internet Transaction Security.
Transactions on the World Wide Web.
Transactions with Web Forms.
Web Form Security Services.
Security Alternatives for Web Forms.
Password Protection.
Network-level Security (IPSEC).
Transport-level Security (SSL).
Application-level Security (SHTTP).
Client Authentication Alternatives.
Product Example: Web Browser with SSL.
Browser Cryptographic Services.
Authentication Capabilities.
Client Security and Executable Contents.
Product Security Requirements.
Product Example: Web Server with SSL.
Web Server Vulnerabilities.
Mandatory Protection.
Product Security Requirements.
Deployment Example: Vending with Exportable Encryption.
Export Restrictions and Transaction Security.
Site Configuration.
Deployment Security Requirements.
11. Secured Electronic Mail.
Security Objectives.
Basic Issues with E-Mail Security.
Basics of Internet Electronic Mail.
Internet E-Mail Software Architecture.
E-Mail Security Problems.
Technology: Off-line Message Keying.
Encryption Tokens.
Technical Security Requirements.
Technology: Digital Signatures.
Attacks on Digital Signatures.
The Digital Signature Standard.
Technical Security Requirements.
Product Example: Secure E-Mail Client.
Basic Secure Client Features.
E-Mail Client Security Issues.
Product Security Requirements.
E-Mail Deployment.
12. Public Key Cerificates.
Security Objectives.
Distributing Public Keys.
Technology: Public Key Certificates.
Generating Public Key Pairs.
Certificate Revocation.
Certification Authority Workstation.
Technical Security Requirements.
Certificate Distribution.
Transparent Distribution.
Interactive Distribution.
Centralized Certification Authority.
Netscape Server Authentication.
Handling Multiple Certification Authorities.
Hierarchical Certification Authority.
PEM Internet Certification Hierarchy.
Private Trees.
PGP “Web of Trust”.
For Further Information.
Appendix A: Glossary.
Appendix B: Bibliography.
Index. 0201924803T01282002
Preface
This book is about delivering data safely across unsafe territory. The features that give the Internet its vitality also make it unsafe, like the streets of a major city. People do not walk carelessly in a vital, teeming city. Likewise, a careful person approaches the Internet with caution. Business data that crosses the public Internet can be forged, modified, or stolen. The Internet's technology and style don't fit well in the traditional mold of common carrier communications, so traditional security techniques don't fit well either.
Cryptography has emerged as the only alternative to protect Internet data, and it does the job well. Modern crypto techniques have evolved from the secret codes of decades past, brilliantly augmented with a deep knowledge of modern mathematics. New cryptographic products and technologies have been developed particularly for Internet applications. This book describes the principal techniques used in today's products, how they work, and how to use them. While we must talk about people "cracking" codes, we will spend far more time looking at system configurations and operating procedures. Configuration and operating errors have often been the bane of crypto system security. Mathematical details alone don't ensure the security of practical crypto systems. Even the most capable products can be defeated by carelessness.
Effective use of crypto systems requires a clear understanding of what your security objectives are and how they depend on important system properties. This book applies cryptographic techniques to particular Internet security goals like site protection, message secrecy, or transaction security. These goals are lined up against today's off-the-shelf products to show which are best suited to meet particular business and security objectives.
Who This Book is For
This book is intended for people who know very little about cryptography but need to make technical decisions about cryptographic security. Many people face this situation when they need to transmit business data safely over the Internet. This often includes people responsible for the data, like business analysts and managers, as well as those who must install and maintain the protections, like information systems administrators and managers. These people are the book's primary audience. Cryptographic concepts are explained using diagrams to illustrate component relationships and data flows. At every step we examine the relationship between the security measures and the vulnerabilities they address. This will guide readers in safely applying cryptographic techniques.
This book requires no prior knowledge of cryptography or related mathematics. Descriptions of low-level crypto mechanisms focus on presenting the concepts instead of the details. Programmers and product developers must look elsewhere for implementation details, and each chapter ends with a list of appropriate references. However, developers will still find a few useful insights here, like why crypto experts are so picky about mathematical arcana like random number generators ("No, it's a pseudorandom number generator!") or why their theoretically unbreakable system is vulnerable to attack.
This book also contains some general tutorial material about the Internet Protocol (IP) and its cousins, but it is best if readers already have a general familiarity with computers, networking, and the Internet. In particular, it helps if readers already understand the notion of message and packet formatting-in other words, your information must be embedded in other information for the network to deliver it correctly.
How this Book is Organized
We start with cryptographic basics, apply them to product evaluation, and then look at example deployment to achieve various business and security objectives. When we understand the risks against which various security measures might protect, we can reasonably trade off between conflicting techniques. Each chapter ends with a list of references that may provide you with deeper explanations when needed. If your particular problem cannot be solved with available products, the references can provide the technical details for implementing custom solutions.
This book is organized around a small number of basic security objectives that are addressed by a few basic Internet cryptographic technologies. The objective of extending one's internal site via the Internet is illustrated with link encryption and network encryption using the IP Security Protocol (IPSEC). The objective of transaction security is illustrated using Secure Socket Layer (SSL) as applied to the World Wide Web. Message-based security is illustrated using Pretty Good Privacy (PGP) and Privacy Enhanced Mail (PEM).
Chapter Summary
The book's contents fall roughly into three parts, starting with low-level but simple techniques and working upward to high-level, complex crypto systems.
- Introduction and traditional crypto (Chapters 1, 2, 3, and 4)
These chapters contain general introductory material and cover traditional crypto techniques. The Introduction provides a cross-reference of security goals against the crypto techniques presented in the book. Traditional crypto includes link encryption and the handling of secret crypto keys. - Network encryption with IPSEC protocols (Chapters 5, 6, 7, and 8)
These chapters describe the IPSEC protocol suite that protects data passing between pairs of hosts on the Internet. These protocols were originally developed for the upcoming IP version 6, but many vendors are incorporating them into existing IP products, like routers and firewalls. - Public key crypto and protocols for transactions (Chapters 9, 10, 11, and 12)
These chapters describe public key crypto techniques and their application in World Wide Web and e-mail protocols. The Web security discussion centers on the SSL protocol and related client/server software. The e-mail discussion examines the techniques of PGP and PEM. Public key certificates are discussed in the final chapter.
A Typical Chapter
Most chapters follow the same general organization. A typical chapter introduces a security service and a particular cryptographic mechanism underlying that service. Chapter information is usually organized in these general sections:
- Security objectives
This section contains a list of objectives you wish to achieve in protecting your information. The product and deployment examples in the chapter are chosen to achieve these objectives. - Basic issues
This section contains an overview of important problems associated with the cryptographic services and mechanisms presented in the chapter. - Technology
There are one or more of these sections, each presenting a technical concept underlying the products introduced. These sections always include a prioritized list of requirements for securely applying the technology. - Product example
There are one or more of these sections to introduce products used in the deployment examples. These sections always include a prioritized list of requirements for assessing potential product choices. - Deployment example
There are one or more of these examples to illustrate different ways of achieving the chapter's stated security objectives. These sections always include a prioritized list of requirements for assessing a particular deployment. - For further information
This section contains an annotated list of references for more in-depth information on a subject. The chapters' lists identify the author and title of the work; the bibliography at the end of this book contains the complete citation.
Crypto Today and Tomorrow
The crypto mechanisms and products appearing in this book were chosen because they illustrate what people can buy off the shelf and use today. Simple, commercially available solutions are given preference over more sophisticated techniques that require extensive vendor support or custom engineering. Naturally this limits the discussion to a fraction of what the technologies can do. However, it is risky to speculate about the behavior of nonexistent products. Countless implementation details will affect their practical effectiveness, so it's pointless to speculate about how they might best work.
This book does not try to predict which future technologies will succeed or fail as easy-to-use products. An elaborate cryptographic infrastructure for safely sharing keys among computer users worldwide has been on the drawing boards for more than a dozen years; the enabling technology and its relatively modest success in off-the-shelf products is described in Chapter 12. Likewise, the chapters on IP security focus on today's products and not on the draft standards for tomorrow. The future is left to future books.
Comments and Questions
Send comments and questions via Internet e-mail to internet-crypto@aw.com. While I tried to focus on techniques that have been used successfully, many of the techniques have not seen extensive use. I'd value any "war stories" or "been there; done that" evaluations based on personal experience. I regret that I can't guarantee a personal reply to every e-mail I receive, but I will try to respond.
0201924803P04062001