Good resources for learning cryptography and OpenSSL?

Question

I'm a programmer and I'm working on a Single Sign-on project using SAML. I want to do all I can to make this as secure as possible. Since making a secure Single Sign-on/SAML solution requires signing xml messages over https and creating various keys/certs etc etc I think I better know about this stuff! I don't want to learn how to be a cryptographer, just know how to properly select the right cryptography method for this project and future projects.

I tend to like to find a few GOOD books and then watch some lectures/talks about a subject so I can really dive into what I'm learning so I can actually grasp all the new vernacular.

So far I bought "Network Security with OpenSSL" and I'm reading it but I have to admit some of the stuff is going over my head.

If your an openssl, public/private key making guru, what helped you get to that level?!? :D

Thanks! Jason

Answer 1

You probably don't want to be working at the level of selecting from among several encryption algorithms, digital signature primitives, etc. That's too low-level, and it requires too much crypto knowledge to get everything right.

Instead, you want to be selecting from full protocols that other have vetted: e.g., TLS, OpenPGP, OpenID, OAuth, etc. There the authors of the protocols have already done the work of figuring out how to piece together the encryption/signing algorithms into a full protocol, and those protocols have been carefully vetted by knowledgeable cryptographers. Therefore, if you can possibly use some existing vetted scheme like this, you will be much better off (and much less likely to have subtle flaws in your crypto).

If I had to recommend one book for the practicing programmer, I would recommend Cryptography Engineering: Design Principles and Practical Applications by Ferguson, SChneier, and Kohno. It is fantastic. But it also describes design of cryptographic schemes at a rather lower level than you probably want to be working, if at all possible.

Answer 2

The usual recommendation: the Handbook of Applied Cryptography. Very good and serious reading, and downloadable for free. It is relatively heavy in math contents, but, let's face it, cryptography is a highly technical subject which suffers from a lack of testability (you cannot easily test whether a given algorithm or protocol is secure) so you cannot realistically make sensible decisions about it without understanding at least part of the implied mathematics (especially the stuff about complexity).