- Marcus J. Ranum

Chief Scientist, V-ONE Corporation

Here, in one comprehensive, soup-to-nuts book, is the solution for Internet security: modern-day cryptography. Written by a security expert with a wealth of practical experience, this book covers network and Internet security in terms that are easy to understand, using proven technology, systems, and solutions. From the client workstation to the Web host to the e-mail server, every aspect of this important topic is examined and explained. The once-daunting subject of cryptography is demystified and applied to today's security challenges. Topics include:

This book is written for people who want to move data safely across the Internet and protect corporate resources from unauthorized access. Using real-life case studies, examples, and commercially available software products, cryptography is presented as a practical solution to specific, everyday security challenges.



0201924803B04062001


About the Author
Richard E. Smith works for Secure Computing Corporation where he provides consulting services in network security to commercial and government organizations, including the National Security Agency. He has also served as principal systems engineer for military network guard systems and the Sidewinder Internet Firewall. He frequently lectures, writes, and conducts seminars on cryptography and computer security. He holds an M.S. and Ph.D. in computer science from the University of Minnesota and a B.S. in engineering from Boston University.

0201924803AB06252001


Excerpt. © Reprinted by permission. All rights reserved.


This book is about delivering data safely across unsafe territory. The features that give the Internet its vitality also make it unsafe, like the streets of a major city. People do not walk carelessly in a vital, teeming city. Likewise, a careful person approaches the Internet with caution. Business data that crosses the public Internet can be forged, modified, or stolen. The Internet's technology and style don't fit well in the traditional mold of common carrier communications, so traditional security techniques don't fit well either.



Cryptography has emerged as the only alternative to protect Internet data, and it does the job well. Modern crypto techniques have evolved from the secret codes of decades past, brilliantly augmented with a deep knowledge of modern mathematics. New cryptographic products and technologies have been developed particularly for Internet applications. This book describes the principal techniques used in today's products, how they work, and how to use them. While we must talk about people "cracking" codes, we will spend far more time looking at system configurations and operating procedures. Configuration and operating errors have often been the bane of crypto system security. Mathematical details alone don't ensure the security of practical crypto systems. Even the most capable products can be defeated by carelessness.



Effective use of crypto systems requires a clear understanding of what your security objectives are and how they depend on important system properties. This book applies cryptographic techniques to particular Internet security goals like site protection, message secrecy, or transaction security. These goals are lined up against today's off-the-shelf products to show which are best suited to meet particular business and security objectives.

Who This Book is For

How this Book is Organized

Chapter Summary

• Introduction and traditional crypto (Chapters 1, 2, 3, and 4)
  These chapters contain general introductory material and cover traditional crypto techniques. The Introduction provides a cross-reference of security goals against the crypto techniques presented in the book. Traditional crypto includes link encryption and the handling of secret crypto keys.
• Network encryption with IPSEC protocols (Chapters 5, 6, 7, and 8)
  These chapters describe the IPSEC protocol suite that protects data passing between pairs of hosts on the Internet. These protocols were originally developed for the upcoming IP version 6, but many vendors are incorporating them into existing IP products, like routers and firewalls.
• Public key crypto and protocols for transactions (Chapters 9, 10, 11, and 12)
  These chapters describe public key crypto techniques and their application in World Wide Web and e-mail protocols. The Web security discussion centers on the SSL protocol and related client/server software. The e-mail discussion examines the techniques of PGP and PEM. Public key certificates are discussed in the final chapter.

A Typical Chapter

• Security objectives
  This section contains a list of objectives you wish to achieve in protecting your information. The product and deployment examples in the chapter are chosen to achieve these objectives.
• Basic issues
  This section contains an overview of important problems associated with the cryptographic services and mechanisms presented in the chapter.
• Technology
  There are one or more of these sections, each presenting a technical concept underlying the products introduced. These sections always include a prioritized list of requirements for securely applying the technology.
• Product example
  There are one or more of these sections to introduce products used in the deployment examples. These sections always include a prioritized list of requirements for assessing potential product choices.
• Deployment example
  There are one or more of these examples to illustrate different ways of achieving the chapter's stated security objectives. These sections always include a prioritized list of requirements for assessing a particular deployment.
• For further information
  This section contains an annotated list of references for more in-depth information on a subject. The chapters' lists identify the author and title of the work; the bibliography at the end of this book contains the complete citation.

Crypto Today and Tomorrow

Comments and Questions

Right to the Point, March 21, 1999
This book at will give you just what you want to know. If you want to get into the bits and Bytes then you read every page and you will be a cryptography expert. If however you just need a broad understanding of the subject then skipping the Bits and bytes will do fine. I sell VPN solutions for a living and this book was a real help.

Very good overview of cryptography on the internet, October 21, 2000


This is a solid, if a little dry and sometimes a bit out of date, high-level overview of cryptography as it is used on the Internet. There are no equations or lines of code, so if you're looking to implement anything this is the wrong book. However if you're looking to learn about IPSEC, public-key crypto, secret keys, SSL, virtual private networks and things like that this is the right book.



The familiar cryptographic couple Alice and Bob are used in many examples to illustrate four general types of attacks made by "Henry the Forger", "Peeping Tom", "Play-it-again Sam" and "Bailey the Switcher". These are used throughout the book and this really simplifies understanding of how various types of cryptography can be attacked. Another one of the strengths of this book is lots of useful pointers to other books and Internet sites to provide supplementary information.



I'm not going to give this book 5 stars because to me that's a perfect book. However I highly doubt you'll be disappointed with this book as an overview to cryptography and how it is used on the Internet.

Very good intro, March 19, 1998
I read this book as I was beginning to research the IPSEC protocol suite and its applications, and I found it to be an invaluable introduction. Anyone interested in how the encryption protocols work on the Internet, or interested in deploying virtual private networking, ought to read this book. The only caveat is that this stuff gets out of date very fast - IPSEC has already been revised since this book came out.

A great handbook for network cryptography, October 30, 2001
I've had this book for a couple years, and find myself going back to it consistently (and recommending it to others on a regular basis). It covers all of the crypto concepts & protocols in an easily readable, thorough fashion. For understanding IPsec, digital signatures, hardware crypto devices, and much more it's a great read. The only reason I don't give it 5 stars is that the SSL connection isn't as complete as I'd like... and for that, I'd get Eric Rescorla's "SSL and TLS".

Of the 100 or so security books on my shelf, this is one of the handful that I refer to on a regular basis.

If this man were a blues musician he'd be blowing the truth!, July 20, 2003
In a sea of charlatans and ego-bloated boasters Richard E. Smith stands as a beacon to whom all technical authors should aspire. As an author, trainer, technical editor and Microsoft security consultant I have amassed a huge library of security books. When I need a refresher on the basics or I'm prepping for YACE (Yet Another Certification Exam) or I just need the solace of an extremely well turned technical phrase, I pickup my well-thumbed copy of Internet Cryptography.

In fact that's the only error in the entire book - the title. The title should reflect the fact that it embraces the majority of fundamental concepts regarding networked computer security. Get it, read it and experience one of the best technical writers in the field! Also consider buying his book on Authentication. Hanging out with Mr. Smith is money and time well-spent.

This book is also absolutely essential to any security professional attempting certification be it CISSP, SANS, Security+, Microsoft or Cisco, et al.