It turns out that cryptography is the least of the issues in cryptographic systems. Good codes are available in good implementations all over the place (one reason the authors warn against implementing your own, since good implementations are very hard). But, as the authors say in their introductory chapter, "Cryptography by itself is fairly useless." They liken strong codes in a weak system to a bank-vault door on a tent. This book provides a first lesson in pouring some concrete into the walls behind that door.
Phrased as a text for a one semester graduate or advanced undergrad class, this highly readable text covers a range of basics - the first and most pervasive being the professional paranoia needed to actively seek out ways to defeat your own systems. The authors cover things you might expect in a crypto course, including ciphers, message digests, key exchange, and a smattering of mathematical basics. There's less of the real crypto material than you might think, however. I mean, what good is the unbreakable code when the bad guy with a root kit can read your passwords from the paging file or /dev/kmem? Instead, this book stands out for things like wiping secrets from memory as fast as you can - if you can, if language design or the physics of computer memory even make it possible. Even things like random numbers and the system clock come under careful scrutiny and analysis of their own. The reader who goes through this book cover to cover comes away with a solid appreciation of the hardware, software, and social issues involved in creating truly secure systems.
But, as the authors take pains to state, this is only an introduction. As happened with Schneier's "Applied Cryptography", it could become "... notorious for the systems that [readers] then designed and implemented on their own" after reading it. Serious cryptographic systems require specialized skills, skills that only a handful of people worldwide have. Since the authors observe that "We don't actually know how to create secure code," it's arguable that no one is qualified. But, to get even as good as the experts are today, a student has to start somewhere. This introductory text gets that student off to that start.
- wiredweird