Cybersecurity Books: Cryptography

Part four of nine. The topic where reading the wrong book breeds overconfidence: someone learns about AES and starts inventing protocols.

The practical advice in all of these books is the same: you do not write your own cryptography, you take a proven library and apply it correctly.

The best modern introduction. It explains how the primitives are built and why they break, without academic machinery and without simplifying them into uselessness.

Topics: random number generators, block and stream ciphers, hash functions and authentication codes, authenticated encryption, RSA and elliptic curves, TLS, post-quantum cryptography, the usual mistakes in application.

Cryptography from the point of view of an engineer who selects and deploys rather than proves theorems.

Topics: choosing a primitive for the task, key exchange, signatures, certificates and public key infrastructure, end-to-end encryption in messengers, cryptography in blockchains, hardware modules and secure enclaves.

On designing systems: where cryptography breaks not in the mathematics but at the seams between components.

Topics: the threat model for a cryptosystem, key management and the key lifecycle, generating randomness, clocks and timestamps, protocols, implementation mistakes.

A textbook with the mathematics in it, but laid out step by step from simple to hard. The authors have made a full video lecture course freely available.

Topics: number theory to the depth you need to follow along, DES and AES, RSA, Diffie-Hellman, elliptic curves, digital signatures, key distribution protocols.

A freely available university course for those who need proofs of security and not just recipes. Heavy going, and it assumes a base.

Topics: formal security models, provable security, zero-knowledge protocols, multi-party computation.

The history of cryptography from antiquity to the arrival of quantum computing. Popular science, but with no lies in the technical part.

Topics: classical ciphers and how they were broken, Enigma and Bletchley Park, the arrival of public key cryptography, the story of PGP and the arguments over the right to encrypt.

A chronicle of the standoff between cryptographers and the state in the seventies and nineties: how encryption became available to everyone and what it cost.

Topics: the conflict over export restrictions, the Clipper chip, the Zimmermann case and PGP, the arguments from both sides in the dispute over backdoors.

Next part: application security.

The whole series:

1. Foundations
2. Offensive security
3. Reverse engineering and malware
4. Cryptography
5. Application security
6. Defense and response
7. The human attack vector
8. Nonfiction investigations
9. Fiction