Practical Cryptography [Paperback]

Practical Cryptography does neither of these things. It presents algorithm classes, why they exist, and what the best known algorithms are in each class. It explains how the various strengths and weaknesses of algorithms in each class combine to make a cryptosystem weaker or stronger. Then it goes on to show you how to use that information to build working cryptosystems.

People have complained about the book's seeming schizophrenia. On one hand, the authors are trying to show you how to build a secure cryptosystem. On the other, they're telling you how hopeless a task it is to build one that has no vulnerabilities, even if you're an expert in such things.

This can be annoying, but I more find it refreshing. Writing a secure cryptosystem is very hard. People should be aware that it is hard, and they are likely to make mistakes. It isn't something that should be attempted lightly. The current state of computer security is depressingly abysmal. People should be encouraged, as much as possible, to not contribute to the problem.

I'm not following my own advice, and I am building a new cryptosystem. I have found this book a more valuable resource than any other book on cryptography that I have yet read. Even if you aren't building your own cryptosystem, I think you will find the insights this book has into complexity and design to be useful tools in evaluating other cryptosystems.

Years ago, Bruce was laid off from AT&T Bell Labs. Since then, Bruce has been using rubes like you to augment his salary. Let's face it; if Bruce were a Ken Thompson or a Claude Shannon, he'd probably still have his job at Bell Labs. But he isn't. Instead he wrote a book and touted himself as an expert to an industry of people who didn't know any better.

What I find truly onerous about his books is the condescending tone that Schneier adopts when addressing the reader. It's if he's saying "I am so much more elite than you, I can't even begin to tell you." I agree with previous reviewers, I was a little put off by the fact that he recommends you hire an expert to implement a cryptosystem. Hire an expert? Then why in god's name should we buy the book? Entertainment value? Please, do tell Bruce, we're all waiting to hear why you made us waste $20.00. Did you buy a new sports car?

Recently I spoke with a PhD, from Brown, who performed decades of research in number theory. He recommended "Cryptography in C and C++," by Michael Welschenbach. He also said "I don't know why people think Applied Cryptography is such a good book. He [Schneier] doesn't seem to understand the mathematics very well." Pick up Applied Cryptography sometime and compare it side-by-side with Welschenbach's book. You'll see what that PhD was talking about.

The truth is that Bruce Schneier is a lot of style without much substance. He's a businessman who can sell himself to an unsuspecting public. What he lacks in ability he makes up for with moxie. Having lived in Minneapolis, I'm more than familiar with the type of silly yuppie pretenders that live on Hennepin Avenue with their nose piercings and their tattoos. Bruce, that ponytail doesn't fool anybody. You're just another suit with something to sell.

With that, Practical Cryptography is a superb text for anyone needing to know the core details of cryptography, but don't want to be bogged down with theoretical and abstract cryptographic ideas.

Where Applied Cryptography is a reference, Practical Cryptography is meant to be a narrative. The book follows the design of a secure cryptographic system from its algorithm selection, design philosophy, analysis, debugging and implementation.

The implementation aspect is crucial, as while there are many books available on the theory of cryptography, there is amazingly little about its practical implementation. While Practical Cryptography is a much easier read than Applied Cryptography, it is primarily geared for the applications

While Practical Cryptography is not as technical as its older brother Applied Cryptography, it is still not a For Dummies type of book. The average reader will likely find most of the book far too abstract for their needs. But for those that are looking for a practical and usable book about implementing cryptography, this is the definitive reference.