I'm a programmer and I'm working on a Single Sign-on project using SAML. I want to do all I can to make this as secure as possible. Since making a secure Single Sign-on/SAML solution requires signing xml messages over https and creating various keys/certs etc etc I think I better know about this stuff! I don't want to learn how to be a cryptographer, just know how to properly select the right cryptography method for this project and future projects.

I tend to like to find a few GOOD books and then watch some lectures/talks about a subject so I can really dive into what I'm learning so I can actually grasp all the new vernacular.

So far I bought "Network Security with OpenSSL" and I'm reading it but I have to admit some of the stuff is going over my head.

If your an openssl, public/private key making guru, what helped you get to that level?!? :D

Thanks! Jason


You probably don't want to be working at the level of selecting from among several encryption algorithms, digital signature primitives, etc. That's too low-level, and it requires too much crypto knowledge to get everything right.

Instead, you want to be selecting from full protocols that other have vetted: e.g., TLS, OpenPGP, OpenID, OAuth, etc. There the authors of the protocols have already done the work of figuring out how to piece together the encryption/signing algorithms into a full protocol, and those protocols have been carefully vetted by knowledgeable cryptographers. Therefore, if you can possibly use some existing vetted scheme like this, you will be much better off (and much less likely to have subtle flaws in your crypto).

If I had to recommend one book for the practicing programmer, I would recommend Cryptography Engineering: Design Principles and Practical Applications by Ferguson, SChneier, and Kohno. It is fantastic. But it also describes design of cryptographic schemes at a rather lower level than you probably want to be working, if at all possible.

| improve this answer | |

The usual recommendation: the Handbook of Applied Cryptography. Very good and serious reading, and downloadable for free. It is relatively heavy in math contents, but, let's face it, cryptography is a highly technical subject which suffers from a lack of testability (you cannot easily test whether a given algorithm or protocol is secure) so you cannot realistically make sensible decisions about it without understanding at least part of the implied mathematics (especially the stuff about complexity).

| improve this answer | |

This book - https://www.feistyduck.com/books/bulletproof-ssl-and-tls/ by Ivan Ristić is best in the market for answering your question. I have read both mentioned books here. But, this book is a gem. It will teach you all the basics with negligible mathematics. It will properly give you recommendation on how to correctly deploy ssl/tls server using openssl. There are many attacks mentioned here on ssl/tls and ways to counter them. This is the best guide for practical purpose.

| improve this answer | |

Just understand the following terms:

  1. data authenticity
  2. data integrity
  3. data encryption

Common in all security protocols ipsec, SSL, any kind of security. How to provide these using openssl:

  1. related words regarding data authentication and integrity, encryption.

    a. hashing, encoding, checksum, message digest.

    b. symmetric key cryptography and public key cryptography

    c. why you need public key cryptography

    d. then go for digital signatures and certificate.

If you can relate all these you get basic understanding ipsec, SSL, pclogin authentication, all kind of security mechanism.

Explore more.... And apply using openssl directly that's easy after the above.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.