Chapter 12: Symmetric Key Cryptography
- Data Encryption Standard (DES)
- Triple DES
- Advanced Encryption Standard (AES). A simple Java code example that can encrypt and decrypt using AES is also presented.
Chapter 13: Asymmetric Key Cryptography
This chapter explains how the asymmetric key cryptography algorithms are working and briefly explains the RSA and Elliptic Curve Cryptography (ECC) algorithms; it also highlights one of the most important problem of the asymmetric key algorithms which is the public key creation and exchange.
Chapter 14: Key Management and Exchange
Key management refers to the process by which keys are generated, stored, agreed upon and revoked. The chapter is structured on 3 parts:
- Key generation (how should new keys be created). For the key generation the authors focus on securely generating random numbers by using the C rand() function, using the Random APIs (CryptGenKey library or java.security API) or random device files.
- Key Storage (how should keys be securely stored so that they cannot be easily stolen). The authors propose some solutions and starts from non secure storage “platforms” (as storing the keys into the compiled code or to a disk) until more secure “platforms” as external devices like smart cards, Hardware Security Modules (HSM).
- Key agreement and exchange (how should to or more parties decide on a session key used to protect the confidentiality of their conversation). The authors present two ways that can be used to initiate a conversation:
- generate a cryptographically random conversation key and encrypt it with a public key
- use Diffie-Hellman key exchange protocol
Chapter 15: MACs and Signature
This chapter presents Message Authentication Codes (MACs) and digital signatures. A MAC is sequence of bits that can be attached to a message to verify where is originated and that is has not been tampered with. For MACs construction the authors present the following algorithms CBC-MAC and HMAC.
Chapter 16: Exercises for Part 3
As usually this chapter contains some questions and problems in order to test the comprehension of the notions discussed in the chapters 12-15.
For me the book fulfill his goal: to present in a (rather) clear and concise way the fundamental notions about the security but what I disliked to this book is the writing style which I find it rather difficult to follow sometimes.