Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a programmer and I'm working on a Single Sign-on project using SAML. I want to do all I can to make this as secure as possible. Since making a secure Single Sign-on/SAML solution requires signing xml messages over https and creating various keys/certs etc etc I think I better know about this stuff! I don't want to learn how to be a cryptographer, just know how to properly select the right cryptography method for this project and future projects.

I tend to like to find a few GOOD books and then watch some lectures/talks about a subject so I can really dive into what I'm learning so I can actually grasp all the new vernacular.

So far I bought "Network Security with OpenSSL" and I'm reading it but I have to admit some of the stuff is going over my head.

If your an openssl, public/private key making guru, what helped you get to that level?!? :D

Thanks! Jason

share|improve this question
up vote 8 down vote accepted

You probably don't want to be working at the level of selecting from among several encryption algorithms, digital signature primitives, etc. That's too low-level, and it requires too much crypto knowledge to get everything right.

Instead, you want to be selecting from full protocols that other have vetted: e.g., TLS, OpenPGP, OpenID, OAuth, etc. There the authors of the protocols have already done the work of figuring out how to piece together the encryption/signing algorithms into a full protocol, and those protocols have been carefully vetted by knowledgeable cryptographers. Therefore, if you can possibly use some existing vetted scheme like this, you will be much better off (and much less likely to have subtle flaws in your crypto).

If I had to recommend one book for the practicing programmer, I would recommend Cryptography Engineering: Design Principles and Practical Applications by Ferguson, SChneier, and Kohno. It is fantastic. But it also describes design of cryptographic schemes at a rather lower level than you probably want to be working, if at all possible.

share|improve this answer

The usual recommendation: the Handbook of Applied Cryptography. Very good and serious reading, and downloadable for free. It is relatively heavy in math contents, but, let's face it, cryptography is a highly technical subject which suffers from a lack of testability (you cannot easily test whether a given algorithm or protocol is secure) so you cannot realistically make sensible decisions about it without understanding at least part of the implied mathematics (especially the stuff about complexity).

share|improve this answer

This book - https://www.feistyduck.com/books/bulletproof-ssl-and-tls/ by Ivan Ristić is best in the market for answering your question. I have read both mentioned books here. But, this book is a gem. It will teach you all the basics with negligible mathematics. It will properly give you recommendation on how to correctly deploy ssl/tls server using openssl. There are many attacks mentioned here on ssl/tls and ways to counter them. This is the best guide for practical purpose.

share|improve this answer

If you are in hurry. Let me give you my personal opinion. Just understand the following words which I am going to list..

1.data authenticity 2.data integrity 3.data encryption

Common in all security protocols ipsec,SSL,any kind of security. How to provide these all using openssl

1.related words regarding to data authentication and integrity,encryption.

a.hashing,encoding,checksum,message digest.

b.symmetric key cryptography and public key cryptography

c.why you need public key cryptography

d.then go for digital signatures and certificate.

If you can relate all these ..you get basic understanding ipsec,SSL,pclogin authentication, all kind of security mechanism.

Explore more.... And apply using openssl directly that's easy after the above.

Hope it helps..do reply if you need more clarification, m ready to help....because I need that too.!! :-)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.