Is Schneier's “Applied Cryptography” current?

Question

I've been recommended Bruce Schneier's 1994 book Applied Cryptography as an introduction to the use and the inner workings of cryptography. Is this book still current and a good introduction?

Answer 1

The handbook of applied cryptography(2001 revision) or simply "The Handbook" is a better book and its free. There are some typo's in Schneier's Applied Cryptography, such as the a typo of md5 which led to a few month delay of one of the md5 collision attacks.

In short many of the fundamental mathematics and discussion of how primitives should be constructed is very good. Schneier's book has a place on my book shelf, although i find that i get more use out of Practical Cryptography.

Answer 2

You'd be better off with the Second Edition, from '96, regardless...

But also note that Schneier's Cryptography Engineering is a much more recent update (2010), albeit that's more to his parallel Practical Cryptography.
If you're more interested in using crypto blocks, I think Applied 2nd ed. is more appropriate for you - however, I admit that I haven't read Crypto Engineering, so I'm just relying on the "back cover"...

Answer 3

It's still pretty good as long as you are aware of what it's missing. My short list, keeping in mind my interests are only for a small subset of cryptography. Also keep in mind I don't know the book by heart and went by the index to confirm my memory, stuff may still be there but under another entry

Regarding algorithms, their mode of operations and protocols using them:

• No AES, AES came a few years after the book
• No SHA-2, came even later than AES
• MD5 still represented as viable, as it was at the time
• ditto for SHA-1, which is still true but not best practice anymore
• no GCM chaining mode, that is now decently popular
• no specific SSL/TLS, x509, ssh or OpenPGP discussion whatsoever, that would cover a good 90% of the practical cryptography usage we see today

Regarding attacks, missing a whole lot of attacks that were discovered/popularized later

• differential power cryptanalysis
• differential timing cryptanalysis
• fault inducing cryptanalysis (I'm likely not using the right term here)
• attacks on protocols using their error reporting, e.g. padding oracles

Those missing attacks are pretty important as e.g. most naive implementations are very vulnerable to them and it's very hard to harden aware implementations against those.

The consequence is that the book cannot be relied on at all for current best practices for the implementor, but is still very educational on the subject. But unsurprisingly, the field changed a lot in 15 years.

Also the book is very light on still used protocols, very heavy on exotic primitives, so of little practical value for people using crypto primitives as tools packaged in a library to implement practical solutions.

I would not buy one new today.

Answer 4

No book is current on cryptography... like many disciplines that are in an area of active research, things are changing too fast.

But Schneier's book is particularly out-of-date. MOV (Handbook of Applied Cryptography) is likewise out-of-date these days, but it has the advantage of having been written by practicing cryptographers, is of much higher quality, and is free online.

The number of crypto books in recent years has exploded. The majority are garbage (probably true in most fields). As with many fields, the only truly reliable way to stay up-to-date is to use online sources and mailing lists.