Problem - Kevin Tafuro

Chapter 3, Input Validation, teaches you how to protect your programs from malicious
user input. In this chapter, we demonstrate techniques for preventing things
like buffer overflow problems, cross-site scripting attacks, format string errors, and
SQL-injection attacks.
Chapter 4, Symmetric Cryptography Fundamentals, covers basic encoding and storage
issues that are often helpful in traditional encryption.
Chapter 5, Symmetric Encryption, shows how to choose and use symmetric encryption
primitives such as AES, the Advanced Encryption Standard.
Chapter 6, Hashes and Message Authentication, focuses on ensuring data integrity
using message authentication codes.
Chapter 7, Public Key Cryptography, teaches you how to use basic public key algorithms
such as RSA.
Chapter 8, Authentication, shows you how to manipulate login credentials. We focus
on implementing password-based systems as securely as possible, because this is
what most people want to use. Here we also cover a wide variety of technologies,
including PAM and Kerberos.
Chapter 9, Networking, provides code for securing your network connections. We
discuss SSLand TLS, and also describe more lightweight protocols for when you do
not want to set up a public key infrastructure. We strongly encourage you to come
here before you go to the cryptography chapters, because it is exceedingly difficult to
build a secure network protocol from parts.
Chapter 10, Public Key Infrastructure, is largely a supplement for Chapter 9 for when
you are using a public key infrastructure (PKI), as well as when you are using the
SSL/TLS protocol. In this chapter, we demonstrate best practices for using a PKI
properly. For example, we show how to determine whether certificates have expired
or are otherwise invalid.
Chapter 11, Random Numbers, describes how to get secure random data and turn
such data into an efficient and secure stream of pseudo-random numbers.
Chapter 12, Anti-Tampering, gives you the foundations necessary to start protecting
your software against reverse engineering. There are no absolute solutions in this
area, but if you are willing to put a lot of effort into it, you can make reverse engineering
significantly more difficult.
Chapter 13, Other Topics, contains a potpourri of topics that did not fit into other
chapters, such as erasing secrets from memory properly, writing a secure signal handler,
and preventing common attacks against the Windows messaging system.
In addition, our web site contains a glossary providing a comprehensive listing of the
many security-related terms used throughout this book, complete with concise definitions.
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Preface | xxi