Applied Cryptography: Protocols, Algorithms, and Source Code in C [Paperback]

Bruce Schneier (Author)

Book Description

Publication Date: October 18, 1996 | ISBN-10: 0471117099 | ISBN-13: 978-0471117094 | Edition: 2nd

". . .the best introduction to cryptography I've ever seen. . . . The book the National Security Agency wanted never to be published. . . ." -Wired Magazine

". . .monumental . . . fascinating . . . comprehensive . . . the definitive work on cryptography for computer programmers . . ." -Dr. Dobb's Journal

". . .easily ranks as one of the most authoritative in its field." -PC Magazine

". . .the bible of code hackers." -The Millennium Whole Earth Catalog

This new edition of the cryptography classic provides you with a comprehensive survey of modern cryptography. The book details how programmers and electronic communications professionals can use cryptography-the technique of enciphering and deciphering messages-to maintain the privacy of computer data. It describes dozens of cryptography algorithms, gives practical advice on how to implement them into cryptographic software, and shows how they can be used to solve security problems. Covering the latest developments in practical cryptographic techniques, this new edition shows programmers who design computer applications, networks, and storage systems how they can build security into their software and systems.

What's new in the Second Edition?
* New information on the Clipper Chip, including ways to defeat the key escrow mechanism
* New encryption algorithms, including algorithms from the former Soviet Union and South Africa, and the RC4 stream cipher
* The latest protocols for digital signatures, authentication, secure elections, digital cash, and more
* More detailed information on key management and cryptographic implementations

Editorial Reviews

Amazon.com Review

Cryptographic techniques have applications far beyond the obvious uses of encoding and decoding information. For Internet developers who need to know about capabilities, such as digital signatures, that depend on cryptographic techniques, there's no better overview than Applied Cryptography, the definitive book on the subject. Bruce Schneier covers general classes of cryptographic protocols and then specific techniques, detailing the inner workings of real-world cryptographic algorithms including the Data Encryption Standard and RSA public-key cryptosystems. The book includes source-code listings and extensive advice on the practical aspects of cryptography implementation, such as the importance of generating truly random numbers and of keeping keys secure.

Review

"the definitive publicly available text on the theory and practice of cryptography" (Computer Shopper, January 2002)

See all Editorial Reviews

Product Details

• Paperback: 758 pages
• Publisher: Wiley; 2nd edition (October 18, 1996)
• Language: English
• ISBN-10: 0471117099
• ISBN-13: 978-0471117094
• Product Dimensions: 7.5 x 1.6 x 9.2 inches
• Shipping Weight: 2.6 pounds (View shipping rates and policies)
• Average Customer Review: 4.6 out of 5 stars  See all reviews (111 customer reviews)
• Amazon Best Sellers Rank: #31,094 in Books (See Top 100 in Books)
  • #14 in Books > Computers & Technology > Security & Encryption > Encryption
  • #14 in Books > Computers & Technology > Programming > Algorithms > Cryptography
  • #26 in Books > Computers & Technology > Business & Management > Privacy

More About the Author

Bruce Schneier is the go-to security expert for business leaders and policy makers. His breakthrough book Applied Cryptography (1994, 1998) explained how the arcane science of secret codes actually works, and was described by Wired as "the book the National Security Agency wanted never to be published." His business-oriented bestseller Secrets and Lies (2000) was called by Fortune "[a] jewel box of little surprises you can actually use." Best known as a refreshingly candid and lucid security critic and commentator, he has appeared in numerous media outlets, including The New York Times, USA Today, Newsweek, and The Wall Street Journal, as well as on NPR, CNN, and the major networks. He has also testified on security before the United States Congress.

Most Helpful Customer Reviews

137 of 145 people found the following review helpful

5.0 out of 5 stars A bit out of date, but highly worth reading January 24, 2002

By Christopher Culver TOP 1000 REVIEWER

Format:Paperback

Bruce Schneier's APPLIED CRYPTOGRAPHY is an excellent book for anyone interested in cryptology from an amateur level to actually being involved in the development of new encryption mechanisms. Schneier's book begins with a simple discussion of what is cryptography, and then he proceeds through the history of various encryption algorithms and their functioning. The last portion of the book contains C code for several public-domain encryption algorithms.

A caveat: this is not a textbook of cryptography in the sense that it teaches everything necessary to understand the mathematical basis of the science. Schneier does not discuss number theory because he expects those who use the relevant chapters of the book will already have training in higher maths. Nonetheless, the book does contain a wealth of information even for the layman.

One helpful part of Schneier's book is his opinion of which encryption algorithms are already broken by the National Security Agency, thus letting the reader know which encryption programs to avoid. There will always be people who encrypt to 40-bit DES even though it is flimsy and nearly instantly breakable, but the readers of APPLIED CRYPTOGRAPHY can greatly improve the confidentiality of their messages and data with this book. Discussion of public-key web-of-trust is essential reading for anyone confused by how public-key signatures work.

APPLIED CRYPTOGRAPHY was published in 1995 and some parts are already out of date. It is ironic that he hardly mentions PGP, when PGP went on to become the most renowned military-strength encryption program available to the public, although it is being superseded by GnuPG. Another anachronism is Schneier's assurance that quantum computing is decades away.... In the years since publication of APPLIED CRYPTOGRAPHY we have seen some strides in quantum computer, even the creation of a quantum computer that can factor the number 15. While this publicly known quantum computer is not at all anything to get excited about, it is certain that more powerful quantum computers are in development and classified by NSA. Because a quantum computer can break virtually any traditional cipher, hiding the message (steganography) is becoming more important than ever. In the era of Schneier's book steganography was unnecessary because ciphertext could withstand brute-force attacks, but with advances in computing power steganography is becoming vital to secure communications. It would be nice to see the book updated with this topic, because cryptography and steganography can no longer be regarded as two distinct fields.

All in all, in spite of its age, APPLIED CRYPTOGRAPHY is recommended to anyone interested in cryptography. It ranks among the essential books on the field, although an updated version is certainly hoped for. Read more ›

54 of 56 people found the following review helpful

5.0 out of 5 stars The most comprehensive text on computer-era cryptology. December 12, 1996

By A Customer

Format:Paperback

Habitues of sci.crypt will be familiar with Bruce Schneier's
*Applied Cryptography*; if any of them have but one text on crypto
for reference, it will almost certainly be *Applied Cryptography*.
It is the de facto standard reference on modern cryptography as
well as serving as an excellent introduction to the subject.

The art is very old - Julius Caesar was the first recorded user of
cryptography for military purposes - and reached a watershed when
computers were put to work in order to break German and Japanese
ciphers. Indeed, that was the first *real* application of electronic
computers. A natural development was the use of computers for the
development of cryptographic systems.

That is where Bruce Schneier's remarkable book begins. It is notable
for two reasons: the breadth and depth of coverage, and the high
standard of technical communication.

As a reference its scope is encyclopaedic, providing descriptions
and assessments of just about every non-military crypto system
developed since computers were first applied to the purpose. There
are also military-cum-government algorithms amongst the collection,
some from the old Soviet Union and others from South Africa. It is
not just an A-Z procession of algorithms; the author progresses
in a logical manner through the many technical aspects of cryptography.

It is common to find that masters of mysterious technical arts are
poor communicators. Bruce Schneier demonstrates exceptional skill
as a technical communicator. Here is a book about an esoteric
subject - one built on a foundation of theoretical mathematics - that
ordinary folk can read.... Sure, one needs to be motivated by an interest
in the subject, and the technical level sometimes requires a more than
ordinary background in number theory and the like - but a degree in
theoretical mathematics is not necessary to derive pleasure and profit
from reading *Applied Cryptography*.

A thirty-page chapter provides a brief, but lucid account of the
necessary mathematical background, spanning information theory,
complexity theory, number theory, factoring, prime number generation,
and modular arithmetic. Even if one needs no other information than
a useful description of modular arithmetic the book is worth looking
at; I can't think of any better source outside full-blown mathematical
texts, and the author does it without being obscure.

The book is divided into parts, beginning with protocols (the
introductory chapter is an excellent overview of crypto as it
is presently applied) from the basic kind through to the esoteric
that find application in digital cash transactions. Public key
encryption, the second - and most significant - watershed in cryptography, is introduced with an explanation of how it is used
in hybrid systems.

Part II deals with cryptographic techniques and discusses the
important issues of key length, key management, and algorithm
types. The strength of a crypto system relies very heavily on the
length of the key, the way in which it is generated, and key
management. A chapter is devoted to the practical aspects of using
algorithms (which one, public-key as against symmetric crypto,
hardware versus software) for various purposes (such as
communications and data storage).

Part III is about particular algorithms, providing for each one
a background of its development, a description, its security, and
how it is likely to stand up to attack. The algorithms are divided
into classes: block (some twenty-one are described);
pseudo-random-sequence generators and stream ciphers (PKZIP is a
stream cipher); real random-sequence generators; one-way hash
functions; public-key; public-key digital signature; identification
schemes; key-exchange algorithms; and other special algorithms.
Many specific algorithms are described with information about
covering patents.

Part IV is entitled, The Real World; in the words of the author,
"It's one thing to design protocols and algorithms, but another
thing to field them in operational systems. In theory, theory
and practice are the same; in practice they are different".
A chapter discusses a number of implementations, including IBM
Secret-Key Management Protocol, Mitrenet (an early public-key
system), ISDN Packet Data Security Overlay, STU-III, Kerberos,
KryptoKnight, Sesame, PEM, PGP, MSP, smart cards, universal
electronic payment system, and Clipper.

Another chapter discusses politics and puts the problems of US
export restrictions into context and deals with patents. It also
has information about bodies with an interest in public access to
cryptography and standards, and legal issues.

An afterword by Matt Blaze should be required reading by everyone
who thinks a good cryptosystem is all that one needs for security;
the human factor can undo the strongest system.

A final part contains C source code for DES, LOKI91, IDEA, GOST,
Blowfish, 3-Way, RC5, A5, and SEAL. North American readers can
obtain a 3-disk set containing code for some forty-one algorithms,
four complete systems, source code for some other utilities,
text files, errata, and notes on new protocols and algorithms.

Who, apart from crypto professionals and aficionados, is likely
to find *Applied Cryptography* of interest? Anyone with an
intelligent interest in the art, and who wants something more
substantial than a quasi adventure account of modern crypto;
anyone with a responsibility for protecting data and/or
communications; network administrators; builders of firewalls;
students and teachers of computer science; programmers; and
anyone with a serious interest in theoretical mathematics - I'm
sure the list could be expanded considerably.

Apart from a book to be read, it is the most complete and up-to-date
resource and reference presently available. The list of references
(1653 of them) is a resource in its own right. An essential
acquisition for libraries.

The book, of necessity, contains highly technical material, but it
can be read. The publishers, Wiley's, are to be congratulated.

Reviewed by Major Keary [e-mail]

DISCLAIMER: The opinions expressed are my own. I have no interest,
financial or otherwise, in the success or failure of this book,
and - apart from a review copy - I have received no compensation
from anyone who has. Read more ›

48 of 52 people found the following review helpful

5.0 out of 5 stars A must have for anyone involved with encryption & security November 26, 2000

By Ben Rothke

Format:Hardcover

Applied Cryptography is quite simply the quintessential guidebook for information about cryptography. It also is one of the finest computer security books ever written. Bruce Schneier is a cryptologist who has a passion for cryptography, and it shows in his masterpiece. Instant classic is an often used oxymoron, yet that term is most appropriate to describe Applied Cryptography. If you have any interest with security and encryption, Applied Cryptography is clearly the definitive publication to reference and the most comprehensive text available about security and encryption. It might sound as if via my high praise for this book that I am getting some type of endorsement, that is not the case. It is just that Applied Cryptography is quite simply the most comprehensive, up-to-date work about cryptography.

The vast array of topics covered by the book is truly astounding in is depth and breadth. There is hardly a single cryptological concept, either minor or major, that the book does not cover. It is not possible to detail everything Applied Cryptography covers. But a few of the topics are: Foundations of cryptography, Protocols, Protocol Building Blocks, Key Lengths, key exchange, key management, Algorithms, the mathematical of cryptography, DES, RSA, One-Way Hash Functions, Symmetric vs. Public-Key cryptography, Public-Key Digital Signature Algorithms, Substitution Ciphers and Transposition Ciphers, Digital Signatures, Random and Pseudo-Random Sequence Generation, PGP, Authentication, Advanced security Protocols, Cryptographic Techniques, Identification Schemes, the politics of cryptography and much (much!) more.

Applied Cryptography also includes the source code for DES, IDEA, BLOWFISH, RC5 and other algorithms.... It even covers encryption algorithms from the former Soviet Union, including GOST.

The magnificence of Applied Cryptography is that Schneier is able to take very complex, abstract ideas and express them in an extremely comprehensible manner. Applied Cryptography therefore lacks the dryness that plagues a lot of textbooks. Schneier is able to take both theoretical and academic ideas, and mold them into practical real-world intelligible book. All in all, Applied Cryptography makes for some very enjoyable and occasionally humorous reading.

One thing I really liked about Applied Cryptography is its index. Rather than using the traditional cumbersome citations such as RIV92b or GOL88 that often take a while to locate, Schneier simply uses numbers. In light that he references over 1600 sources, it makes looking up the sources an incredible time saver. What is extremely impressive about Applied Cryptography is that Schneier quotes from every imaginable source. From general security periodicals, scholarly academic journals, conference proceedings, government publications and official standards, Schneier has been there.

Schneier writes at length about whether a crypto customer should choose an algorithm for that is publicly published algorithm (i.e., DES, RSA, Blowfish) or to use a proprietary algorithm that belongs to a specific manufacturer. With a proprietary algorithm, Schneier writes that it is impossible to determine how truly secure the algorithm is, given that the owners do not generally make their code available for open inspection. There is even the possibility that the manufacturer (or government, if under federal contract) has put in a back door into the algorithm. Schneier states that: "Putting your trust in a single manufacturer, consultant, or government is asking for trouble. The NSA has some of the world's best cryptographers working for it, but it is hard to know if they're telling you all you know."

This idea then segues into the (in)famous Clipper chip and concept of key escrow. As a world class cryptographer, Schneier has major issues with the concept of Clipper, calling it "Orwellian" Schneier feels that encryption is too important to be left to the government and Clipper advances the power of the government over the right of the people.

In conclusion, Applied Cryptography is a must have book for anyone involved with encryption and security. Read more ›