Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Handbook of Applied Cryptography

cacr.uwaterloo.ca

Post reply on HN
Print view View original

11–20 of 23 posts

Re: Handbook of Applied Cryptography

#11

Post by h0h0h0h0111 »

imjonse wrote: post #7

While the fundamentals are always relevant, IIRC this book has been dated even 10 years ago, when Schneier's Cryptography Engineering was already recommended instead if you wanted practical advice. For a more theoretically backed approach Dan Boneh's book ( https://toc.cryptobook.us/ ) is a very good resource.

Dan Boneh is great - his lecture series on Youtube is wonderful.

A book I enjoyed a lot, that straddles the line between approachable and theoretical with a focus on implementation, is Serious Cryptography by Jean-Philippe Aumasson (one of the people behind blake2/3, amongst other things): https://nostarch.com/seriouscrypto

Re: Handbook of Applied Cryptography

#13

Post by nmadden »

imjonse wrote: post #7

While the fundamentals are always relevant, IIRC this book has been dated even 10 years ago, when Schneier's Cryptography Engineering was already recommended instead if you wanted practical advice. For a more theoretically backed approach Dan Boneh's book ( https://toc.cryptobook.us/ ) is a very good resource.

Personally, I feel that HAC has aged surprisingly well compared to other books of that era. It’s focus on theory and fundamentals helps there. I still think it has some of the best introductions to cryptography topics. But, yes, read it in combination with a newer resource like Coursera’s Crypto I course, or Serious Cryptography by Aumasson. (I wouldn’t recommend the Boneh/Shoup book for newcomers. It is still very much a draft).

Re: Handbook of Applied Cryptography

#14

Post by lbriner »

baby wrote: post #4

Warning: this is more of a reference book. If you’re looking for a more gentle introduction to all things cryptography check my book https://www.amazon.com/Real-World-Cryptography-David-Wong/dp...

My experience is that a lot of people could learn what they need from a few pages of crib sheets. Symmetrical, hashing, asymmetrical, key lengths etc. As soon as you need to know more about the nuts and bolts of different systems, you are already straying into the territory of needing the really deep and mathematical treaties that some of these books represent.

How many Developers need to know much more than choosing between bcrypt/scrypt/argon2/pbkdf2/etc. for password hashing and the relative merits of each?

Re: Handbook of Applied Cryptography

#15

Post by quux »

antirez wrote: post #9
imjonse wrote: post #7

While the fundamentals are always relevant, IIRC this book has been dated even 10 years ago, when Schneier's Cryptography Engineering was already recommended instead if you wanted practical advice. For a more theoretically backed approach Dan Boneh's book ( https://toc.cryptobook.us/ ) is a very good resource.

I wonder if Cryptography Engineering, while updated, is a good book as Applied Cryptography, that really was a pretty inspired one.

IIRC the issue with Applied Cryptography was that while it was the best resource for learning the math behind different crypto systems work and how to implement different algorithms it gave almost no guidance about how to actually use them in the real world. Which led to a lot of people deploying insecure systems based on just reading AC.

My understanding is that Cryptography Engineering and Practical Cryptography address this and focus on using crypto in the real world rather than mathematics and theory.

Re: Handbook of Applied Cryptography

#17

Post by User23 »

quux wrote: post #15
antirez wrote: post #9

Earlier quoted context omitted.

I wonder if Cryptography Engineering, while updated, is a good book as Applied Cryptography, that really was a pretty inspired one.

IIRC the issue with Applied Cryptography was that while it was the best resource for learning the math behind different crypto systems work and how to implement different algorithms it gave almost no guidance about how to actually use them in the real world. Which led to a lot of people deploying insecure systems based on just reading AC. My understanding is that Cryptography Engineering and Practical Cryptography ad…

> it gave almost no guidance about how to actually use them in the real world

This is funny, because an old buddy of mine who did a brief stint at the NSA let slip that they almost never compromise the algorithm, it's virtually always the implementation where the weakness lies.

Re: Handbook of Applied Cryptography

#18

Post by FergusArgyll »

pluto_modadic wrote: post #3

I love this. In my college library there's a row of books on mathematics, a single shelf unit on computer science (system admin, SQL, the works), a shelf on cryptography most books on RSA two books on ECC and ONE single book on essoteric protocols, and it's this one (not this edition) covers things like blind signing, dining cryptographers, homomorphic encryption, zero knowledge proofs, all before the whole bitcoin t…

> all before the whole bitcoin thing got annoying.

interesting, I feel like Bitcoin (& entire crypto ecosystem) has been good for cryptography.

More research, more innovative ideas, for ex zero knowledge proofs have been getting a lot of traction because of ETH etc. though I think it was discovered before cryptocurrencies.

Re: Handbook of Applied Cryptography

#19

Post by stoneman24 »

User23 wrote: post #17
quux wrote: post #15

Earlier quoted context omitted.

IIRC the issue with Applied Cryptography was that while it was the best resource for learning the math behind different crypto systems work and how to implement different algorithms it gave almost no guidance about how to actually use them in the real world. Which led to a lot of people deploying insecure systems based on just reading AC. My understanding is that Cryptography Engineering and Practical Cryptography ad…

> it gave almost no guidance about how to actually use them in the real world This is funny, because an old buddy of mine who did a brief stint at the NSA let slip that they almost never compromise the algorithm, it's virtually always the implementation where the weakness lies.

The obligatory xlcd reference https://xkcd.com/538/.

Always the easiest path, defeat the implementation.

Re: Handbook of Applied Cryptography

#20

Post by xpe »

lbriner wrote: post #14
baby wrote: post #4

Warning: this is more of a reference book. If you’re looking for a more gentle introduction to all things cryptography check my book https://www.amazon.com/Real-World-Cryptography-David-Wong/dp...

My experience is that a lot of people could learn what they need from a few pages of crib sheets. Symmetrical, hashing, asymmetrical, key lengths etc. As soon as you need to know more about the nuts and bolts of different systems, you are already straying into the territory of needing the really deep and mathematical treaties that some of these books represent. How many Developers need to know much more than choosing…

Crib sheets (i.e. listing various flavors of encryption algorithms) IMO work reasonably well when people have a decent conceptual mindset to start with.

I strive to assume very little when it comes to the knowledge of I meet. With cryptography, even less so. For example, given some developers you interact with, to what degree do they understand encryption versus digesting? I'm not even talking about the details; I'm talking about the big picture of when each is applicable.

So, even before something like a crib sheet of techniques, some people would benefit from something even simpler: an "IF-THEN" flowchart helping them recognize when they want, say, encryption versus digesting versus something else.

Post reply on HN