September 2009
Intermediate to advanced
464 pages
9h 58m
English
book
24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them
by Michael Howard, David LeBlanc, John Viega
Content preview from 24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
Start your free trial
SIN 23Improper Use of PKI, Especially SSL
OVERVIEW OF THE SIN
Public Key Infrastructure, or PKI, is commonplace on the Internet. It’s used in SSL/TLS (hereinafter SSL) communications; it’s used in IPSec, smart-card logon, and secure e-mail using S/MIME. But it’s notoriously hard to get right.
From this point on, we will talk in terms of SSL because it is prevalent, but for most purposes, we’re really talking about PKI-related sins as a whole.
SSL, the Secure Sockets Layer (along with its successor, Transport Layer Security, or TLS), is the most popular means to create secure network connections. It’s widely used in Web browsers to secure potentially sensitive operations such as HTTP-based banking because from a user’s perspective, “it just ...