Practical Cryptography in Python, 1st ed. Learning Correct Cryptography by Example
Auteurs : Nielson Seth James, Monson Christopher K.
Develop a greater intuition for the proper use of cryptography. This book demystifies cryptographic internals and teaches you how to write basic cryptographic algorithms in Python.
Cryptography is the life blood of the digital world?s security infrastructure. From governments around the world to the average consumer, most communications are protected in some form or another by cryptography. These days, even Google searches are encrypted.
Despite its ubiquity, cryptography is easy to misconfigure, misuse, and misunderstand. Developers building cryptographic operations into their applications are not typically experts in the subject, and may not fully grasp the implication of different algorithms, modes, and other parameters.
The concepts in this book are largely taught by example, including incorrect uses of cryptography and how "bad" cryptography can be broken. By digging into the guts of cryptography, you can experience what works, what doesn't, and why.
What You?ll Learn
- Understand where cryptography is used, why, and how it gets misused
- Know what secure hashing is used for and its basic properties
- Generate hashes in Python: recommended algorithms and why SHA-1 is being retired
- Know what block ciphers are used for and their basic properties
- Encrypt with AES in Python: recommended algorithms and modes, and what can go wrong
- Know what public keys and private keys are used for and their basic properties, and how the security of an algorithm depends on parameters such as padding
- Provide message integrity and digital signatures using keyed hashes and asymmetric cryptography; know how a certificate differs from a key, and why it matters
- Securely generate a shared symmetric session key using asymmetric encryption
- Use modern symmetric ciphers such as AES-GCM and CHACHA
- Utilize TLC connections and modern technologies such as certificate pinning and certificate transparency (CT) logs
Who This Book Is For
IT administrators and software developers familiar with Python. Although readers may have some knowledge of cryptography, the book assumes that the reader is starting from scratch.
Introduction: Cryptography. What is it, and what goes wrong?
To understand where cryptography is used and why and to understand how it gets misused
· A Gentle Introduction to cryptography
· Uses of cryptography
· What goes wrong
· The dangerous waters of Internet guidance
· The cryptodoneright.org Project
· An overview of this book
· Setting up your Python environment
· Further reading
Chapter 1: Hashing
To understand what secure hashing is used for and its basic properties. How to generate hashes in Python. What are the recommended algorithms and why SHA-1 is being retired?
· Dive right in! Introducing Python’s hashlib library.
· So what is a hash, exactly?
· Using hashes for fingerprinting files and data
· You can also hash passwords!
· Cracking weak passwords.
· Using salts
· Finding an MD5 collision
· SHA1 and SHAttered
Chapter 2: Symmetric Encryption
To understand what block ciphers are used for and their basic properties. How to encrypt with AES in Python. What are the recommended algorithms, modes, and what can go wrong
· Dive right in! Introducing the cryptography module
· So what is encryption, exactly?
· Block ciphers, DES, AES, and more!
· Using AES CBC and CTR modes
· And that’s why you don’t use ECB mode!
· Exploiting malleability: altering encrypted messages
· Weak keys: the best lock is no good if the key is under the mat
· Other key and IV management issues
Chapter 3: Asymmetric Encryption: Public Keys and Private Keys
To understand what public keys and private keys are used for and their basic properties. How the security of an algorithm depends on parameters, such as “padding.”
· Dive right in! Simple 1-way secure messages
· What is asymmetric encryption and how is it different?
· Encrypting and decrypting with RSA
· Measuring the performance or RSA (or lack thereof)
· Exploiting RSA encryption without padding
· Exploiting RSA encryption with PKCS 1.5 padding
· Weak keys again?
· The private key MUST stay private… obviously.
Chapter 4: Message Integrity, Signatures, and Certificates
To understand how keyed hashes and asymmetric cryptography can be used to provide message integrity and digital signatures. Also, how a certificate is different from a key and why it matters.
· Dive right in! An overly simplistic message authentication code
· MACs, HMAC, and CBC-MAC
· Digital Signatures = Hash + Asymmetric Encryption
· Replay attacks
· Certificates and public keys
· Certificate Authorities
· Root of trust
· Verifying or exploiting a chain of trust
· Dealing with untrustworthy roots: pinning, trust-on-first-use and other approaches
Chapter 5: Combining Asymmetric and Symmetric Algorithms
To understand how asymmetric encryption is typically used to generate a symmetric session key.
· Dive right in! Exchange AES keys with RSA
· Asymmetric and symmetric; like chocolate and peanut butter
· Securing data in motion and data at rest
· Using passwords to generate keys
· Exploiting a key exchange with replay attacks
· Brute-forcing passwords
· Putting it all together
Chapter 6: More Symmetric Algorithms: Authenticated Encryption
Modern cryptographic algorithms for authenticated encryption.
· Dive right in! An AES GCM example· An “authenticated” encryption mode
· Re-examining CBC MAC
· AES CCM Mode
· AES GCM Mode
· Exploiting parameters in authenticated modes
· Verifying data in practice
Chapter 7: TLS Communications
How TLS is implemented. Using TSL libraries. Common parameters and problems to be aware of.
· Dive Right In! Connect to a TLS website!
· TLS part1: The key exchange
· TLS part2: The certificate verification
· TLS part3: bulk transport
· Recommended parameters for TLS 1.2 and 1.3
· Using OpenSSL with Python for TLS communications
· What goes wrong with certificates
· Solutions: pinning, trust-on-first-use and others
Dr. Seth James Nielson is the founder and chief scientist of Crimson Vista, Inc., a boutique computer security consulting company. He is also the director of advanced research projects at the Johns Hopkins University Information Security Institute where he teaches courses in network security. At Johns Hopkins, he has been working on developing the cryptodoneright.org knowledge base, through a generous grant from Cisco. In working on this project, he came to better understand the knowledge gap between cryptographers and developers. He believes that this book can make a real difference in how cryptography is used and deployed in cyberspace.
Dr. Chris Monson has a PhD in machine learning, has spent over a decade at Google in various engineering and leadership roles, and is currently the director of machine learning at Data Machines Corp. He has broad experience writing and teaching programming courses in multiple languages, and has worked in document password recovery, malware detection, and large-scale secure computing.
Teaches you the basics of writing Python programs that use cryptography
Offers clear guidance on the correct use of cryptography in a landscape good advice is hard to come by
Provides examples of bad cryptography along with source code that breaks it
Date de parution : 09-2019
Ouvrage de 250 p.
À paraître, réservez-le dès maintenant
34,80 €Ajouter au panier