Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been recommended Bruce Schneier's 1994 book Applied Cryptography as an introduction to the use and the inner workings of cryptography. Is this book still current and a good introduction?

share|improve this question
    
I suspect that soon questions like this will be transferred to a cryptography StackExchange. –  David Cary Apr 17 '11 at 5:26
    
@David: Unfortunately, it is still far from beta. –  user1633 Apr 17 '11 at 6:15

4 Answers 4

up vote 5 down vote accepted

The handbook of applied cryptography(2001 revision) or simply "The Handbook" is a better book and its free. There are some typo's in Schneier's Applied Cryptography, such as the a typo of md5 which led to a few month delay of one of the md5 collision attacks.

In short many of the fundamental mathematics and discussion of how primitives should be constructed is very good. Schneier's book has a place on my book shelf, although i find that i get more use out of Practical Cryptography.

share|improve this answer
2  
Thanks. I especially like the news at that link: CRC Press has generously given us permission to make all chapters available for free download. –  nealmcb Apr 17 '11 at 5:41
5  
The typo was not in Schneier's book itself; the typo was in the Chinese translation of this book that caused XioaYun Wang's team to get the endianness wrong it their original MD5 attack. –  Fixee Apr 18 '11 at 23:30
    
@Fixee interesting. –  Rook Apr 18 '11 at 23:35

No book is current on cryptography... like many disciplines that are in an area of active research, things are changing too fast.

But Schneier's book is particularly out-of-date. MOV (Handbook of Applied Cryptography) is likewise out-of-date these days, but it has the advantage of having been written by practicing cryptographers, is of much higher quality, and is free online.

The number of crypto books in recent years has exploded. The majority are garbage (probably true in most fields). As with many fields, the only truly reliable way to stay up-to-date is to use online sources and mailing lists.

share|improve this answer

You'd be better off with the Second Edition, from '96, regardless...

But also note that Schneier's Cryptography Engineering is a much more recent update (2010), albeit that's more to his parallel Practical Cryptography.
If you're more interested in using crypto blocks, I think Applied 2nd ed. is more appropriate for you - however, I admit that I haven't read Crypto Engineering, so I'm just relying on the "back cover"...

share|improve this answer
    
As someone who implements the occasional crypto algorithm but would never design one, I've found Cryptography Engineering a lot more helpful. It's more recent, but more importantly it has more tips for implementers. –  Gilles Apr 17 '11 at 16:25
    
@Gilles, thanks, I guess I should get me a copy of crypto eng. I've been putting it off... –  AviD Apr 17 '11 at 17:00

It's still pretty good as long as you are aware of what it's missing. My short list, keeping in mind my interests are only for a small subset of cryptography. Also keep in mind I don't know the book by heart and went by the index to confirm my memory, stuff may still be there but under another entry

Regarding algorithms, their mode of operations and protocols using them:

  • No AES, AES came a few years after the book
  • No SHA-2, came even later than AES
  • MD5 still represented as viable, as it was at the time
  • ditto for SHA-1, which is still true but not best practice anymore
  • no GCM chaining mode, that is now decently popular
  • no specific SSL/TLS, x509, ssh or OpenPGP discussion whatsoever, that would cover a good 90% of the practical cryptography usage we see today

Regarding attacks, missing a whole lot of attacks that were discovered/popularized later

  • differential power cryptanalysis
  • differential timing cryptanalysis
  • fault inducing cryptanalysis (I'm likely not using the right term here)
  • attacks on protocols using their error reporting, e.g. padding oracles

Those missing attacks are pretty important as e.g. most naive implementations are very vulnerable to them and it's very hard to harden aware implementations against those.

The consequence is that the book cannot be relied on at all for current best practices for the implementor, but is still very educational on the subject. But unsurprisingly, the field changed a lot in 15 years.

Also the book is very light on still used protocols, very heavy on exotic primitives, so of little practical value for people using crypto primitives as tools packaged in a library to implement practical solutions.

I would not buy one new today.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.