book

Real-World Cryptography

Name: Real-World Cryptography
Author: David Wong
ISBN: 9781617296710

by David Wong

September 2021

Beginner to intermediate

400 pages

12h 36m

English

Manning Publications

Audiobook available

Read now

Unlock full access

Real-World Cryptography
Copyright
dedication
contents
front matter
prefaceA book, years in the makingThe real-world cryptographer curriculumWhere most of the bugs areA need for a new book?acknowledgmentsabout this bookWho should read this bookStudentsSecurity practitionersDevelopers who use cryptography directly or indirectlyCryptographers curious about other fieldsEngineering and product managers who want to understand moreCurious people who want to know what real-world crypto is aboutAssumed knowledge, the long versionHow this book is organized: A roadmapAbout the codeliveBook discussion forumabout the authorabout the cover illustration
Part 1. Primitives: The ingredients of cryptography
1 Introduction
1.1 Cryptography is about securing protocols1.2 Symmetric cryptography: What is symmetric encryption?1.3 Kerckhoff’s principle: Only the key is kept secret1.4 Asymmetric cryptography: Two keys are better than one1.4.1 Key exchanges or how to get a shared secret1.4.2 Asymmetric encryption, not like the symmetric one1.4.3 Digital signatures, just like your pen-and-paper signatures1.5 Classifying and abstracting cryptography1.6 Theoretical cryptography vs. real-world cryptography1.7 From theoretical to practical: Choose your own adventure1.8 A word of warningSummary
2 Hash functions
2.1 What is a hash function?2.2 Security properties of a hash function2.3 Security considerations for hash functions2.4 Hash functions in practice2.4.1 Commitments2.4.2 Subresource integrity2.4.3 BitTorrent2.4.4 Tor2.5 Standardized hash functions2.5.1 The SHA-2 hash function2.5.2 The SHA-3 hash function2.5.3 SHAKE and cSHAKE: Two extendable output functions (XOF)2.5.4 Avoid ambiguous hashing with TupleHash2.6 Hashing passwordsSummary
3 Message authentication codes
3.1 Stateless cookies, a motivating example for MACs3.2 An example in code3.3 Security properties of a MAC3.3.1 Forgery of authentication tag3.3.2 Lengths of authentication tag3.3.3 Replay attacks3.3.4 Verifying authentication tags in constant time3.4 MAC in the real world3.4.1 Message authentication3.4.2 Deriving keys3.4.3 Integrity of cookies3.4.4 Hash tables3.5 Message authentication codes (MACs) in practice3.5.1 HMAC, a hash-based MAC3.5.2 KMAC, a MAC based on cSHAKE3.6 SHA-2 and length-extension attacksSummary
4 Authenticated encryption
4.1 What’s a cipher?4.2 The Advanced Encryption Standard (AES) block cipher4.2.1 How much security does AES provide?4.2.2 The interface of AES4.2.3 The internals of AES4.3 The encrypted penguin and the CBC mode of operation4.4 A lack of authenticity, hence AES-CBC-HMAC4.5 All-in-one constructions: Authenticated encryption4.5.1 What’s authenticated encryption with associated data (AEAD)?4.5.2 The AES-GCM AEAD4.5.3 ChaCha20-Poly13054.6 Other kinds of symmetric encryption4.6.1 Key wrapping4.6.2 Nonce misuse-resistant authenticated encryption4.6.3 Disk encryption4.6.4 Database encryptionSummary

5 Key exchanges
5.1 What are key exchanges?5.2 The Diffie-Hellman (DH) key exchange5.2.1 Group theory5.2.2 The discrete logarithm problem: The basis of Diffie-Hellman5.2.3 The Diffie-Hellman standards5.3 The Elliptic Curve Diffie-Hellman (ECDH) key exchange5.3.1 What’s an elliptic curve?5.3.2 How does the Elliptic Curve Diffie-Hellman (ECDH) key exchange work?5.3.3 The standards for Elliptic Curve Diffie-Hellman5.4 Small subgroup attacks and other security considerationsSummary
6 Asymmetric encryption and hybrid encryption
6.1 What is asymmetric encryption?6.2 Asymmetric encryption in practice and hybrid encryption6.2.1 Key exchanges and key encapsulation6.2.2 Hybrid encryption6.3 Asymmetric encryption with RSA: The bad and the less bad6.3.1 Textbook RSA6.3.2 Why not to use RSA PKCS#1 v1.56.3.3 Asymmetric encryption with RSA-OAEP6.4 Hybrid encryption with ECIESSummary
7 Signatures and zero-knowledge proofs
7.1 What is a signature?7.1.1 How to sign and verify signatures in practice7.1.2 A prime use case for signatures: Authenticated key exchanges7.1.3 A real-world usage: Public key infrastructures7.2 Zero-knowledge proofs (ZKPs): The origin of signatures7.2.1 Schnorr identification protocol: An interactive zero-knowledge proof7.2.2 Signatures as non-interactive zero-knowledge proofs7.3 The signature algorithms you should use (or not)7.3.1 RSA PKCS#1 v1.5: A bad standard7.3.2 RSA-PSS: A better standard7.3.3 The Elliptic Curve Digital Signature Algorithm (ECDSA)7.3.4 The Edwards-curve Digital Signature Algorithm (EdDSA)7.4 Subtle behaviors of signature schemes7.4.1 Substitution attacks on signatures7.4.2 Signature malleabilitySummary
8 Randomness and secrets
8.1 What’s randomness?8.2 Slow randomness? Use a pseudorandom number generator (PRNG)8.3 Obtaining randomness in practice8.4 Randomness generation and security considerations8.5 Public randomness8.6 Key derivation with HKDF8.7 Managing keys and secrets8.8 Decentralize trust with threshold cryptographySummary
Part 2. Protocols: The recipes of cryptography
9 Secure transport
9.1 The SSL and TLS secure transport protocols9.1.1 From SSL to TLS9.1.2 Using TLS in practice9.2 How does the TLS protocol work?9.2.1 The TLS handshake9.2.2 How TLS 1.3 encrypts application data9.3 The state of the encrypted web today9.4 Other secure transport protocols9.5 The Noise protocol framework: A modern alternative to TLS9.5.1 The many handshakes of Noise9.5.2 A handshake with NoiseSummary
10 End-to-end encryption
10.1 Why end-to-end encryption?10.2 A root of trust nowhere to be found10.3 The failure of encrypted email10.3.1 PGP or GPG? And how does it work?10.3.2 Scaling trust between users with the web of trust10.3.3 Key discovery is a real issue10.3.4 If not PGP, then what?10.4 Secure messaging: A modern look at end-to-end encryption with Signal10.4.1 More user-friendly than the WOT: Trust but verify10.4.2 X3DH: the Signal protocol’s handshake10.4.3 Double Ratchet: Signal’s post-handshake protocol10.5 The state of end-to-end encryptionSummary
11 User authentication
11.1 A recap of authentication11.2 User authentication, or the quest to get rid of passwords11.2.1 One password to rule them all: Single sign-on (SSO) and password managers11.2.2 Don’t want to see their passwords? Use an asymmetric password-authenticated key exchange11.2.3 One-time passwords aren’t really passwords: Going passwordless with symmetric keys11.2.4 Replacing passwords with asymmetric keys11.3 User-aided authentication: Pairing devices using some human help11.3.1 Pre-shared keys11.3.2 Symmetric password-authenticated key exchanges with CPace11.3.3 Was my key exchange MITM’d? Just check a short authenticated string (SAS)Summary
12 Crypto as in cryptocurrency?
12.1 A gentle introduction to Byzantine fault-tolerant (BFT) consensus algorithms12.1.1 A problem of resilience: Distributed protocols to the rescue12.1.2 A problem of trust? Decentralization helps12.1.3 A problem of scale: Permissionless and censorship-resistant networks12.2 How does Bitcoin work?12.2.1 How Bitcoin handles user balances and transactions12.2.2 Mining BTCs in the digital age of gold12.2.3 Forking hell! Solving conflicts in mining12.2.4 Reducing a block’s size by using Merkle trees12.3 A tour of cryptocurrencies12.3.1 Volatility12.3.2 Latency12.3.3 Blockchain size12.3.4 Confidentiality12.3.5 Energy efficiency12.4 DiemBFT: A Byzantine fault-tolerant (BFT) consensus protocol12.4.1 Safety and liveness: The two properties of a BFT consensus protocol12.4.2 A round in the DiemBFT protocol12.4.3 How much dishonesty can the protocol tolerate?12.4.4 The DiemBFT rules of voting12.4.5 When are transactions considered finalized?12.4.6 The intuitions behind the safety of DiemBFTSummary
13 Hardware cryptography
13.1 Modern cryptography attacker model13.2 Untrusted environments: Hardware to the rescue13.2.1 White box cryptography, a bad idea13.2.2 They’re in your wallet: Smart cards and secure elements13.2.3 Banks love them: Hardware security modules (HSMs)13.2.4 Trusted Platform Modules (TPMs): A useful standardization of secure elements13.2.5 Confidential computing with a trusted execution environment (TEE)13.3 What solution is good for me?13.4 Leakage-resilient cryptography or how to mitigate side-channel attacks in software13.4.1 Constant-time programming13.4.2 Don’t use the secret! Masking and blinding13.4.3 What about fault attacks?Summary
14 Post-quantum cryptography
14.1 What are quantum computers and why are they scaring cryptographers?14.1.1 Quantum mechanics, the study of the small14.1.2 From the birth of quantum computers to quantum supremacy14.1.3 The impact of Grover and Shor’s algorithms on cryptography14.1.4 Post-quantum cryptography, the defense against quantum computers14.2 Hash-based signatures: Don’t need anything but a hash function14.2.1 One-time signatures (OTS) with Lamport signatures14.2.2 Smaller keys with Winternitz one-time signatures (WOTS)14.2.3 Many-times signatures with XMSS and SPHINCS+14.3 Shorter keys and signatures with lattice-based cryptography14.3.1 What’s a lattice?14.3.2 Learning with errors (LWE), a basis for cryptography?14.3.3 Kyber, a lattice-based key exchange14.3.4 Dilithium, a lattice-based signature scheme14.4 Do I need to panic?Summary
15 Is this it? Next-generation cryptography
15.1 The more the merrier: Secure multi-party computation (MPC)15.1.1 Private set intersection (PSI)15.1.2 General-purpose MPC15.1.3 The state of MPC15.2 Fully homomorphic encryption (FHE) and the promises of an encrypted cloud15.2.1 An example of homomorphic encryption with RSA encryption15.2.2 The different types of homomorphic encryption15.2.3 Bootstrapping, the key to fully homomorphic encryption15.2.4 An FHE scheme based on the learning with errors problem15.2.5 Where is it used?15.3 General-purpose zero-knowledge proofs (ZKPs)15.3.1 How zk-SNARKs work15.3.2 Homomorphic commitments to hide parts of the proof15.3.3 Bilinear pairings to improve our homomorphic commitments15.3.4 Where does the succinctness come from?15.3.5 From programs to polynomials15.3.6 Programs are for computers; we need arithmetic circuits instead15.3.7 An arithmetic circuit to a rank-1 constraint system (R1CS)15.3.8 From R1CS to a polynomial15.3.9 It takes two to evaluate a polynomial hiding in the exponentSummary
16 When and where cryptography fails
16.1 Finding the right cryptographic primitive or protocol is a boring job16.2 How do I use a cryptographic primitive or protocol? Polite standards and formal verification16.3 Where are the good libraries?16.4 Misusing cryptography: Developers are the enemy16.5 You’re doing it wrong: Usable security16.6 Cryptography is not an island16.7 Your responsibilities as a cryptography practitioner, don’t roll your own cryptoSummary
Appendix. Answers to exercises
Chapter 2Chapter 3Chapter 6Chapter 7Chapter 8Chapter 9Chapter 10Chapter 11
index

Content preview from Real-World Cryptography

Appendix. Answers to exercises

Chapter 2

Can you tell if a hash function provides hiding and binding if used as a commitment scheme?.

A hash function is hiding thanks to the pre-image resistance property; that is, if your input is random enough so that no one can guess it. To fix that, you can generate a random number and hash it with your input, and later, you can reveal both your input and the random number to open your commitment. A hash function is binding thanks to the second pre-image resistance property.

By the way, there is no way this string represents 256 bits (32 bytes), right? How is this secure then?.

We don’t care about collision resistance. We only care about second pre-image resistance. Thus, we can truncate the digest to ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781617296710Publisher Support Publisher Website Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Real-World Cryptography

by David Wong

Appendix. Answers to exercises

Chapter 2

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.