Problem - Kevin Tafuro

Chapter CHAPTER 4 4
Symmetric Cryptography
Fundamentals
Strong cryptography is a critical piece of information security that can be applied at
many levels, from data storage to network communication. One of the most common
classes of security problems people introduce is the misapplication of cryptography.
It’s an area that can look deceptively easy, when in reality there are an
overwhelming number of pitfalls. Moreover, it is likely that many classes of cryptographic
pitfalls are still unknown.
It doesn’t help that cryptography is a huge topic, complete with its own subfields,
such as public key infrastructure (PKI). Many books cover the algorithmic basics;
one example is Bruce Schneier’s classic, Applied Cryptography (John Wiley & Sons).
Even that classic doesn’t quite live up to its name, however, as it focuses on the
implementation of cryptographic primitives from the developer’s point of view and
spends relatively little time discussing how to integrate cryptography into an application
securely. As a result, we have seen numerous examples of developers armed
with a reasonable understanding of cryptographic algorithms that they’ve picked up
from that book, who then go on to build their own cryptographic protocols into their
applications, which are often insecure.
Over the next three chapters, we focus on the basics of symmetric cryptography.
With symmetric cryptography, any parties who wish to communicate securely must
share a piece of secret information. That shared secret (usually an encryption key)
must be communicated over a secure medium. In particular, sending the secret over
the Internet is a bad idea, unless you’re using some sort of channel that is already
secure, such as one properly secured using public key encryption (which can be
tough to do correctly in itself). In many cases, it’s appropriate to use some type of
out-of-band medium for communication, such as a telephone or a piece of paper.
In these three chapters, we’ll cover everything most developers need to use symmetric
cryptography effectively, up to the point when you need to choose an actual network
protocol. Applying cryptography on the network is covered in Chapter 9.
116
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.