20 of 20 people found the following review helpful:
3.0 out of 5 stars
Written for those without prior crypto experience, November 27, 1998
By A Customer
This review is from: Java Cryptography (Java Series) (Paperback)
This book is intended to teach experienced Java programmers how to add cryptographic elements to their applications. The text is not intended to teach encryption algorithms, basic Java programming, or the overall Java security model: there are other books that fulfill those functions. There is one other limitation: much of the book relies on the Java Cryptography Extensions (JCE) which are only available to those in the United States and Canada (nudge, nudge, wink, wink).
Chapter one lists some fundamentals of encryption and the relationship to security. There are also a couple of programs right off the bat that will let you explore message digests, and encrypting and decrypting messages. The basics of confidentiality, authentication, and some major cryptographic algorithms are outlined in chapter two. The explanations are quite terse, but not out of line with the aim of the book. Java Security Architecture (JCA) is explained in chapter three, along with a quick overview of the API (Application Programming Interface) and SPI (Service Provider Interface). Chapter four introduces Java's own pseudo-random number generator, plus programming for key seeds from keyboard timing. Key management, in chapter five, is somewhat weak. The APIs only deal with hierarchical key certification, but this may simply be an example of Knudsen dealing strictly with the language, and leaving the concepts to others. I was, however, bemused at some passages that may have suffered from a lack of copy editing: for example, one section that seemed to confuse production of Message Authentication Codes with working on Macintosh computers. Authentication of various types is covered quite well in chapter six. Chapter seven's guide to encryption covers details not normally dealt with in cryptography texts because it must handle all matters related to getting an encryption algorithm to actually function in an application.
Chapter eight gives enough detail about signed applets to prove that they are going to be browser specific for a while. Security provider programming is covered in chapter nine, using the ElGamal algorithm as an example. A sample application is created using an encrypted version of the talk utility in chapter ten. An e-mail application is created in chapter eleven using th provider previously generated in chapter nine. Chapter twelve closes off by looking at security design for the system overall.
Appendices review BigInteger arithmetic in Java, the Base64 encoding scheme (an option for converting binary objects to text characters for e-mailing), Java archive files, Javakey, and a quick reference for the Java cryptography classes as covered in the book.
Knudsen states that the book is written, as far as possible, without assuming any prior knowledge of cryptography. In this aim he succeeds rather well. The programmer with no background in encryption can still add a reasonable layer of security to his or her application. Those who study further, of course, will be able to ensure a higher level of protection and reliability.
Help other customers find the most helpful reviews
Was this review helpful to you? Yes
No
27 of 29 people found the following review helpful:
1.0 out of 5 stars
Teaches cryptography the wrong way, December 31, 1998
By A Customer
This review is from: Java Cryptography (Java Series) (Paperback)
The goal of this book is to show how to implement a secure application. It does not achieve this. Generally, it is a good idea to rely on algorithms and protocol that are published, well analyzed and preferably standardized. Specially public key cryptography has many pitfalls that are difficult to avoid.
However, the author of this book designs his own key exchange protocol and uses ad-hoc padding schemes. This procedure sets a bad example for the reader. The result is what one has to expect from an ad-hoc design: The applications have serious design flaws. For example the ElGamal signature scheme in chapter 9 does not use a hash function besides other omissions. The padding scheme for the ElGamal encryption simply adds 0's and therefore does not prevent chosen message attacks. The key exchange protocol in chapter 10 constructs a session key from two halves that are sent seperately. Each half can be attacked seperately in a reply attack, etc.
To conclude, this book does certainly not show the proper use of cryptography, and hence is hardly worth reading.
Help other customers find the most helpful reviews
Was this review helpful to you? Yes
No
6 of 6 people found the following review helpful:
4.0 out of 5 stars
Great for beginners, August 9, 2000
This review is from: Java Cryptography (Java Series) (Paperback)
If you're new to cryptography in general, I'd recommend this book. Within the first chapter I was able to understand quite a few concepts that I had been struggling with. Thanks to the author for not trying to talk over everyone's heads and just getting things laid out simply, with good diagrams. Another reader had the opinion that this book does not introduce the Best Way of doing things, so it's not worth reading. I would disagree. You should read this book with the understanding that it's not going to make you a master cryptography expert, but will give a good introduction.
Help other customers find the most helpful reviews
Was this review helpful to you? Yes
No
