Modern Cryptography: Theory and Practice [Hardcover]

The focus of this book is the correct design of cryptographic protocols that resist attack. This is in contrast to books like Applied Cryptography, which focuses on the tools and the building blocks used to construct systems, glossing over how to use those things together to build strong systems. While the innards of block ciphers and so on can be interesting, Schneier himself is prone to saying something along the lines of, "The world is filled with insecure systems built by people who read Applied Cryptography". That is, in order to build secure systems with cryptography, one should understand how to use cryptographic tools properly. We do not need to know how the tools themselves work... we can take it for granted as long as we understand their behavior.

It must be said that the average person shouldn't be designing their own cryptographic protocols, either. One of the things this book does well is demonstrate the large number of non-intuitive ways in which cryptographic protocols can go wrong. For example, the chapters on authentication schemes demonstrate a large number of schemes authored by reputable cryptographers that turned out to have significant weaknesses.

For the above reason, this probably isn't a text that needs to be on everybody's desk. I would say it is essential for anyone who wants to understand why protocol design is so hard, and it is also valuable to the few people who will go on to build new protocols, particularly graduate students in cryptography.

Here's what I like about the book:
- Cryptography is a rapidly evolving field, and this book is quite up to date, covering AES and other recent protocols. This is quite in contrast to books like Applied Cryptography, which is painfully out of date.

- The text is pretty lucid, staying away from arcane mathematical symbols when possible, and explaining them well when not. While it's a bit more math-y and not quite as fun to read as Applied Cryptography, it is nearly as good in this respect, and the content is far better.

- It's the first book I've seen to do a good job covering the state of the art in provable security techniques. It introduces fairly recent provable security models, and does so in a way that it doesn't take a mathematician to understand.

- Its coverage of topics is great, particularly in that it spends much time examining real-world protocols such as SSL/TLS, SSH and Kerberos.

If you are in the target audience for this book, you won't regret buying it. Even at the $54.99 list price (which is what I paid, sadly), you shouldn't feel even remotely cheated, particularly considering the fact that there are shorter books with only a fraction of the content that cost a lot more.