Cryptography For Dummies

• Cryptography is the most effective way to achieve data security
  and is essential to e-commerce activities such as online shopping,
  stock trading, and banking

• This invaluable introduction to the basics of encryption covers
  everything from the terminology used in the field to specific
  technologies to the pros and cons of different implementations

• Discusses specific technologies that incorporate cryptography
  in their design, such as authentication methods, wireless
  encryption, e-commerce, and smart cards

• Based entirely on real-world issues and situations, the
  material provides instructions for already available technologies
  that readers can put to work immediately

• Expert author Chey Cobb is retired from the NRO, where she held
  a Top Secret security clearance, instructed employees of the CIA
  and NSA on computer security and helped develop the computer
  security policies used by all U.S. intelligence agencies

Autorentext
Chey Cobb, CISSP, author of Network Security For Dummies, was Chief Security Officer for a National Reconnaissance Office (NRO) overseas location. She is a nationally recognized computer security expert.

Zusammenfassung

• Cryptography is the most effective way to achieve data security and is essential to e-commerce activities such as online shopping, stock trading, and banking
• This invaluable introduction to the basics of encryption covers everything from the terminology used in the field to specific technologies to the pros and cons of different implementations
• Discusses specific technologies that incorporate cryptography in their design, such as authentication methods, wireless encryption, e-commerce, and smart cards
• Based entirely on real-world issues and situations, the material provides instructions for already available technologies that readers can put to work immediately
• Expert author Chey Cobb is retired from the NRO, where she held a Top Secret security clearance, instructed employees of the CIA and NSA on computer security and helped develop the computer security policies used by all U.S. intelligence agencies

Inhalt

Introduction 1

About This Book 2

How to Use This Book 2

What You Don't Need to Read 3

Foolish Assumptions 3

How This Book Is Organized 3

Part I: Crypto Basics & What You Really Need to Know 4

Part II: Public Key Infrastructure 4

Part III: Putting Encryption Technologies to Work for You 4

Part IV: The Part of Tens 4

Part V: Appendixes 5

Icons Used in This Book 5

Where to Go from Here 5

Part I: Crypto Basics & What You Really Need to Know 7

Chapter 1: A Primer on Crypto Basics 9

It's Not about James Bond 9

Go with the rhythm 10

Rockin' the rhythm 11

Getting to Know the Basic Terms 12

What Makes a Cipher? 13

Concealment ciphers 13

Substitution ciphers 14

Transposition ciphers 15

Hash without the corned beef 16

XOR what? 17

Breaking Ciphers 20

Not-so-secret keys 20

Known plaintext 21

Pattern recognition 21

What a brute! 21

Cryptosystems 22

Everyday Uses of Encryption 23

Network logons and passwords 23

Secure Web transactions 25

ATMs 26

Music and DVDs 27

Communication devices 28

Why Encryption Isn't More Commonplace 28

Difficulty in understanding the technology 29

You can't do it alone 29

Sharing those ugly secrets 30

Cost may be a factor 30

Special administration requirements 31

Chapter 2: Major League Algorithms 33

Beware of Snake Oil 34

Symmetric Keys Are All the Same 37

The key table 37

Key generation and random numbers 38

Protecting the Key 39

Symmetric Algorithms Come in Different Flavors 40

Making a hash of it 40

Defining blocks and streams 42

Which is better: Block or stream? 44

Identifying Symmetric Algorithms 45

Des 45

Triple DES 45

Idea 46

Aes 46

Asymmetric Keys 47

Rsa 48

Diffie-Hellman (& Merkle) 49

Pgp 50

Elliptical Curve Cryptography 50

Working Together 52

Chapter 3: Deciding What You Really Need 53

Justifying the Costs to Management 53

Long-term versus short-term 54

Tangible versus intangible results 55

Positive ROI 55

Government due diligence 60

Insurers like it! 61

Presenting your case 61

Do You Need Secure Communications? 62

Secure e-mail 62

Instant Messaging (IM) 64

Secure e-commerce 64

Online banking 66

Virtual Private Networks (VPNs) 66

Wireless (In)security 68

Do You Need to Authenticate Users? 69

Who are your users? 70

Authentication tokens 71

Smart cards 72

Java tokens 73

Biometrics 74

Do You Need to Ensure Confidentiality and Integrity? 75

Protecting Personal Data 75

What's It Gonna Cost? 77

Chapter 4: Locks and Keys 79

The Magic Passphrase 80

The weakest link 81

Mental algorithms 82

Safety first! 84

Passphrase attacks 86

Don't forget to flush! 87

The Key Concept 88

Key generation 89

Protecting your keys 90

What to do with your old keys 91

Some cryptiquette 91

Part II: Public Key Infrastructure 93

Chapter 5: The PKI Primer 95

What Is PKI? 96

Certificate Authorities (CAs) 97

Digital Certificates 98 Desktops, laptops,...