Slashdot Mirror
Practical Cryptography
Schneier is one of the world's foremost experts, not just on cryptography, but also on security. It was as he delved deeper into the security of cryptographic systems that he realised that even though - theoretically at least - cryptography could be made arbitrarily secure, this was one of the more tractable problems in the security puzzle. For this reason, his company, Counterpane repositioned itself as a managed security company, rather than continuing to focus solely on cryptography. This transition was also reflected in his publication of Secrets and Lies (SL), which is very different in tone and focus from Applied Cryptography (AC). So where does Practical Cryptography (PC) fit in, and what does it offer? For me, the answer is that it lies pretty much squarely in the middle of the line reaching from AC to SL.
There is no shortage of products in the cryptography arena, but the vast majority of these attract undisguised scorn from professional cryptographers (at least those who can be bothered to comment on them), and although I am only an amateur in this field, I take it as axiomatic that only peer-reviewed cryptosystems (algorithms, protocols, etc) which have stood the test of time are worth taking even a preliminary peek at. This includes many that are described in AC. However, One of the problems with AC, openly acknowledged by the author, is that it contains essentially no implementation details. Furthermore, the cryptographic field has moved on since its publication, most notably with the adoption of Rijndael as the Advanced Encryption Standard, now a mandated Federal Information Processing Standard.
The source code to AC has been available from pretty much the moment of the book's publication, but one of the problems which faced a would-be cryptographic coder, is how to produce a working cryptographic product based on the routines that one could lay one's hands on. Merely incorporating the source code in a program does not a cryptosystem make: as Schneier points out cryptography is hard. And this is where this new book is invaluable: it tells you in great detail how hard it is, what the hardest parts are, and how you can maximise the return on the effort you may invest in developing cryptographic software.
The book pulls no punches, and does not gloss over any issues relating to implementing cryptographic systems. It deals with all the major components of a practical cryptosystem: the book's major sections are titled Message Security, Key Negotiation, Key Management and Miscellaneous.
Within each of these sections there are several chapters, covering virtually all the salient points imaginable, right down to the fundamentals. For example, the first chapter of the Key Management section deals with the clock. It explains from first principles the need for a clock: "At first glance, [a clock] is a decidedly un-cryptographic primitive, but because the current time is often used in cryptographic systems, we need a reliable clock." It is this sort of attention to particular implementation details that turns PC from a mere recipe book into an invaluable reference and a true cookbook.
Another invaluable feature is the generous use of pseudocode snippets, not only for algorithmic details, such as MACs and block cyphers, but also for higher-level operations like sending and receiving messages.
Ferguson and Schneier are refreshingly frank, too. Where they believe strongly in something, they let you know it. For example, the first paragraph of chapter 23, Standards, contains the statement that "[s]ecurity standards rarely work," while the authors go even further when dealing with X.509 certificates, stating on p.339, "[w]hatever you do, stay away from X.509 certificates. If you need a reason, read [40] and weep". This candour is refreshing, especially when juxtaposed with the weasel words that so many consultants and software vendors seem to rely on. However, this advice is not just given in curmudgeonly fashion, and when the authors discuss the matter of X.509 in a different context, they add, humorously, "[i]f you must use X.509, you have out condolences."
I am tempted to continue to analyse the book at great length, but to save space I will just highlight some further jewels from this work:
- Implementation issues such as swap files, language-specific memory handling behaviour, caches, etc. are covered in enough detail for you to understand how to do things, and more importantly, how not to do things.
- Randomness, pseudo-randomness and entropy are covered in enough depth for an implementor to avoid pitfalls, and pseudocode examples are given.
- Mathematical topics such as prime numbers, groups and large integer arithmetic are described in excellent detail.
- PKI, its promise, and failure are covered with wit and wisdom.
Is there anything I didn't like about the book? Frankly, no. Some might complain that it is priced too high (it lists at USD50 for the softcover, and USD70 for the hardcover), but it is printed on acid-free paper, and the density of useful advice is such that it outstrips in value many works which cost half the price or less.
If you are interested in crypto, do yourself a favour: buy this book.
You can purchase Practical Cryptography from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Isn't this review a violation of the DMCA?
I'm not joking...if you take the wording of the law literally?
Why do I h8 apple?
It's probably bad form to be FPer to one's own review, but just to let you know there is an oopsie in my review concerning experts. A paragraph got lost (my fault). Schneier and Ferguson start their chapter with the warning about self-proclaimed experts I mention, but they realldo do recommend using experts: just be careful that they really ARE experts, not flim-flam artists.
Call me old fashioned, but I like a dump to be as memorable as it is devastating - Bender
This book is, sort of an executive summary of Applied Cryptography (AC), with some updates. It touches upon the insights that Scheneier mentioned in Secret and Lies (like crypto is the easy part and that won't solve security). It mentions some newer material, notably AES related stuff. The description is, in effect, a simplified version of AC. Also, it doesn't try to cover everything, and yes, some explanations about the practical applications are stressed slightly more than in AC.
So if you want to be practical, just go over the essential and latest stuff, this is a good book to read. But I must say that it's not as fun to read as AC. Not as many jokes, and absolutely no crazy stuff (like bio-computing and the significance of dark matters). Oh well, maybe that's what being practical means... But it doesn't give you the feeling of throughness that AC gave. Maybe this comes from my reading AC too much in detail (I actually translated the whole book into Japanese), but I think it is inherent in the book itself. In trying to cover as much ground as possible, the book hurries a lot.
So if you are in a hurry to cover just enough important stuff, get this book. And if you need some explanation on the newer stuff, get this. But I also recommend getting AC as well.
Jakb sdf aksvbmk aklsdfj alksjd SjkczLzeq adjskf sdkimz zoikjp ead!
Stop by my site where I write about ERP systems & more
Cryptography supports terrorism.
Reading about implementing cryptography supports terrorism.
Reading reviews about books about implementing cryptography supports terrorism.
Now turn off the computer, stand over there in the corner and we'll be by to pick you up in a little while. And remember, running supports terrorism.
Hopefully this helps the good guys more then the bad ones though...
Go calculate something.
Buying this book will probally send out alot of red flags with the D.H.S, what with the patriot act and all...
(But your genius will be unappreciated by the Slashdot moderators...)
I've always liked the tagline on the back of the Applied Cryptography book:
"The Book the National Security Agency wanted never to be published..."
M@
Krispy Cream is people
Applied Cryptography is a must read. Few books invoke the proper fear and respect cryptology deserves, with example after example of why your l33t encryption should not be used for anything more valuable than your Slashdot UID. Great examples, solid code, lots of history... If this is even half the book Applied Cryptography was, get your checkbook ready.
+++ UGUCAUCGUAUUUCU
Is there anything I didn't like about the book? Frankly, no. Some might complain that it is priced too high (it lists at USD50 for the softcover, and USD70 for the hardcover), but it is printed on acid-free paper, and the density of useful advice is such that it outstrips in value many works which cost half the price or less.
Taking a look at my paperback copy of Applied Cryptography, it's listed at $55, so I hardly consider that any more expensive. And I paid full cover price for this bugger, as opposed to getting it online for a song, like I should have.
I don't think Applied Cryptography had a hardcover edition available, at least of the Second Edition. I certainly may consider picking that thing up. Hopefully it'll be able to stick together for awhile.
And on another note, what isn't printed on acid-free paper these days? Aside from little paperback novels, etc. I thought that was all done away with.
...I'll be buying it with cash, just like I buy all my other crypto and security books.
His book, Applied Cryptography is widely regarded as the most accessible, and one of the most important books on cryptographic algorithms ever published. "A colleague once told me that the world was full of bad security systems designed by people who read Applied Cryptography" - Bruce Schneier (author of Applied Cryptography). Quote from Secrets & Lies.
"If anything can go wrong, it will." - Murphy
I'd rather see a review like: "This book was so impenetrable that teams of scientists in academia and the NSA, working with the online computing grid will take many times the age of the universe to understand the first chapter alone."
taken! (by Davidleeroth) Thanks Bingo Foo!
I'm really glad this is printed on acid-free paper. Because, you know, I'm really likely to be wanting to read this book fifty years from now.
Before you worry about finding a storage medium which will survive for a long time, think about how long the information you're storing will be useful.
Tarsnap: Online backups for the truly paranoid
I wish that the bignum libraries were a little more straightforward. For example, lots of cryptographic algorithms involve enormous numbers like 1024 bit primes and so forth. But I think libcrypto's bn_* function family is something like 4000 lines of code, and GMP is enormous too. For secure applications, I want to be able to understand and audit the entire library, so I wish they were written for readability instead of speed or whatever they're currently going for. The encryption protocol is useless if there is an overflow on line 8 billion of some underlying library.
I can't comment on Practical Cryptography as Wiley haven't yet shipped my pre-ordered copy of the book, grumble.....
BUT I can recommed 2 books that any person interested in implementing cryptography should have on their shelf:
"Mary had a crypto key, she kept it in escrow, and everything that Mary said, the Feds were sure to know."
At the bottom of the X.509 certificates link
An engineer, a chemist, and a standards designer are stranded on a desert island with absolutely nothing on it. One of them finds a can of spam washed up by the waves.
The engineer says "Taking the strength of the seams into account, we can calculate that bashing it against a rock with a given force will open it up without destroying the contents".
The chemist says "Taking the type of metal the can is made of into account, we can calculate that further immersion in salt water will corrode it enough to allow it to be easily opened after a day".
The standards designer gives the other two a condescending look, gazes into the middle distance, and begins "Assuming we have an electric can opener...".
SCO to Hell
So you get 3 karma points for submitting an article and THEN in the comments section you add something you "forgot" to include in your review and get modded up +5. How can I get in on this scam?
A bit OT, but I've always thought it would be intersting to see a cryptology book released in electronic form .... encrypted. Kind of a "you must be at least this tall to ride this ride" kind of thing.
slurp slurp slurp
in today's world, which is primarily occupied by Micro$oft zombies. Why, I can encrypt my documents manually, employ a random encryption algorythm, and read them [with my eyes] even while encrypted! Take a look here:
!dAOl Si gNiLWoH EhT HO !sTHgIN eTiLNoOm No TNeMeC DLoC eNoTs eHt tSnIAgA lAEnYObwOc SEpaR OCaTRdMc
To the average Borg drone, this looks like M$ Windows just before a fatal crash, and quite possibly THE BLUE SCREEN OF DEATH! Hence, the drone will quickly exit the document, save as many other open documents, and restart the computer.
Applied Crypto is certainly a quality, wide-ranging tome on crypto. For years though, there have been a couple very good books with more implementation details. The Handbook of Applied Crypto from Menezes, et al comes immediately to mind. Either of the two books by Neal Koblitz are excellent. I also like to recommend Decrypted Secrets from Bauer. The Handbook of Applied Crypto is available as a free download from the author's site:
> Jakb sdf aksvbmk aklsdfj alksjd SjkczLzeq adjskf sdkimz zoikjp ead!
Jakbs dfaks vbmka klsdf jalks jdSjk czLze qadjs kfsdk imzzo ikjpe adxxx
3.243F6A8885A308D313
A classic for cryptographers is Handbook of Applied Cryptography by Menzenes, Van Oorschot and Vanstone. Very accessible imho. You can even download it and read it completely before you buy it.
should be
...
1f7301f3 and 4fddfb54
it is worth it
(Using md5() ... )
f828955ca01f9c03a726acf5cc2dbe65 a2a551a6458a8de22446cc76d639a9e9 f97c5d29941bfb1b2fdab0874906ab82 8bf8854bebe108183caeb845c7676ae4 8fc42c6ddf9966db3b09e84365034357 ff5cabab0a5c826fdef2e562e6eb600a 79a352706fc69e70b68a457015ccaf0f d31ed91ae4198835d730482e66e6f58a d529e941509eb9e9b9cfaeae1fe7ca23 8134b84030cca5285ed0e0b31ba06f10 ed2b5c0139cec8ad2873829dc1117d50 d581a916de79aa75cc53096b385c9751 37598dad8f8805ce708ba8c4f67ce367 07ccfe360dce69b84595428e2ec1c1cc ed2b5c0139cec8ad2873829dc1117d50 5452e83a743c0fccd85d322daf053e43 6e57d6c47d23024e41f4a1aac73a3ea9 a77b3598941cb803eac0fcdafe44fac9 f970e2767d0cfe75876ea857f92e319b 6f96cfdfe5ccc627cadf24b41725caa4 9e327d39a0b27bf040f1693e140f3a35 c376109ef8d15c46a24936b7d0e0b560 b971be0e2e7176b90d5501eca32a0226 8fc42c6ddf9966db3b09e84365034357 e91e6348157868de9dd8b25c81aebfb9 8bf8854bebe108183caeb845c7676ae4 52e5783fb2be233a7219dabe6d7f8056 b31df235e8aee38fd08600c353af2b52 21582c6c30be1217322cdb9aebaf4a59 6f96cfdfe5ccc627cadf24b41725caa4 c6e76a72f258857bed843acfbd216ae5 21582c6c30be1217322cdb9aebaf4a59 cc935c5faf4c8f7a0468d7552a9b8138 23f9c1b08ef269ebf4b403ed833a5b03 336d5ebc5436534e61d16e63ddfca327 a2d4bfc626b142774660d5deb9a7f0a7 7d0db380a5b95a8ba1da0bca241abda1 8451fc653eaa269664a6d9b46a238424 336d5ebc5436534e61d16e63ddfca327 e0d00b9f337d357c6faa2f8ceae4a60d f0441366488bd123be0e5fb7d6c03c2b 910955a907e739b81ec8855763108a29 4ab8710d781ba5b13aaf561cafd896b7 ca97d7fcd88d424065b3fb8b1b63495b 6dbdba779ddf6dd053c3785e6bd9d035 9e925e9341b490bfd3b4c4ca3b0c1ef2 a77b3598941cb803eac0fcdafe44fac9 f97c5d29941bfb1b2fdab0874906ab82 8bf8854bebe108183caeb845c7676ae4 8fc42c6ddf9966db3b09e84365034357 addec426932e71323700afa1911f8f1c f3e9e0675feca77f67a7e32898b75dc2 8d8a1b73876ca678cc3afa372e5199de 13b5bfe96f3e2fe411c9f66f4a582adf 8fc42c6ddf9966db3b09e84365034357 e91e6348157868de9dd8b25c81aebfb9 9176a98110716496410503c80b9d1af5 39e61d57e9209611edd4f884e9e47c11 9e925e9341b490bfd3b4c4ca3b0c1ef2 e23ee923e08a2bceae9b0e0d2d3eba80 65b50b04a6af50bb2f174db30a8c6dad ff0cb426c0698739bc5e410313a00f7e 2c843f3bf026929da412897f5c9e7b8e 41a23ff0e62bc39c571d717b71cc6d54 53d8f4d1e2b5be0d0abfde443f017359 f970e2767d0cfe75876ea857f92e319b 0cc175b9c0f1b6a831c399e269772661 6ce207e8f7bc1afc40ba5e1d8a181478 e91e6348157868de9dd8b25c81aebfb9 ff0cb426c0698739bc5e410313a00f7e 7c67f7869117923c58b29eee5f760c5f 7761127a460aaf290ed953098284dd1a 791b0c20a65a95dc903f4928be58156c 01b6e20344b68835c5ed1ddedf20d531 1818d506396d77b3d035f719885c4cd1 26eb20e01947f0cc7bbc2cdb458a499b ed2b5c0139cec8ad2873829dc1117d50 c48d7856c321faa3bf30956cfff0217a 77631ca4f0e08419b70726a447333ab6 1e3057527650f36abc8cfa0131920cda a77b3598941cb803eac0fcdafe44fac9 07ccfe360dce69b84595428e2ec1c1cc 17b9b0dd34a74166f3b3c4b11fc1bd8e 13b5bfe96f3e2fe411c9f66f4a582adf 65b50b04a6af50bb2f174db30a8c6dad e16704d9e243b23b4f4e557748d6eef6 8bf8854bebe108183caeb845c7676ae4 ffb85bfe93f1d2f1654a7048b87f0403 be5d5d37542d75f93a87094459f76678 b8b1ddae9aafe82ed29b973cf9f0b031 4a9e308719d8ca12ef4532207f77a801 8b7af514f25f1f9456dcd10d2337f753 a2a551a6458a8de22446cc76d639a9e9 f016441d00c16c9b912d05e9d81d894d 29e4b66fa8076de4d7a26c727b8dbdfa 13b5bfe96f3e2fe411c9f66f4a582adf f303f9a15cddbe8ee0296511a8b04b30 be5d5d37542d75f93a87094459f76678 1818d506396d77b3d035f719885c4cd1 d98a07f84921b24ee30f86fd8cd85c3c 733d43480c8589b1368e5def6b480415 64ef07ce3e4b420c334227eecb3b3f4c 34207c34eb6aad72ecc67c7d0f2ff324 e2e0ab9c9510bf61fd17296bae8d3d24 567904efe9e64d9faf3e41ef402cb568 5440e70c43cc02aba90d879c888e6e09 bba95533b6f582e295b52fffd93cbb7c 64ef07ce3e4b420c334227eecb3b3f4c aef17870e6a01b4873b45c988b05243f 1977c9daa1d67de51a4651abdb160c09 b208dbc3701c54737a24ac451d75b324 be5d5d37542d75f93a87094459f76678 4a2028eceac5e1f4d252ea13c71ecec6 5440e70c43cc02aba90d879c888e6e09 0d149b90e7394297301c90191ae775f0 aaffefb077c8b53e5895bc6a47b4c2c4 39e61d57e9209611edd4f884e9e47c11 f51712e8f064b4d2080adbe9721c69ed 8fc42c6ddf9966db3b09e84365034357 a363b8d13575101a0226e8d0d054f2e7 a2a551a6458a8de22446cc76d639a9e9 21582c6c30be1217322cdb9aebaf4a59 0d149b90e7394297301c901
OK. Here is a challange.
My crypto algorithm is to take an arbitary irrational number(t), and a large number(z) as a secure key(this is symmetrical encryption, not public key). Then use the decimal expansion of t starting at position z as a one time pad for your message(M).
To decrypt the result(R) to retriev M, you need to know the key (t,z). eg. (t,z) might be (sqrt(2),1127304).
Anyone care to crack my encryption scheme?
Bonus points for readers if some people post messages encrypted with this scheme, with the key kept secret. And then see if anyone can break the encryption scheme and reveal the message M (without knowing the key).
My understanding is that this is possible, but I am only half convinced. Someone prove it for me.
Thanks.
Has Slashdot considered adding a little about the credentials of book reviewers, especially on more technical topics?
I am not in any way passing judgement on "jpetts" here. He, or she, is quite articulate, but could be anywhere from an expert with years of experience to someone who's "read a book or two" and talks a very good game.
Generally I try to assess a writer by coherence and consistency when I don't know the subject material myself. But that only gets one so far - and I usually spot some discrepancies when I do know the subject material.
So the rough outlines of the writer's experience would add (or subtract, as the case may be) a little confidence in their accuracy.
Check out reviews of LOTS of cryptography books here -- most with an associated set of prerequisite book reading, math, and computer language skills.
I put the 'fun' in fundamentalism
It's fun reading!
I think it needs to be applied 13 times before the data is sufficiently encrypted.
Applying it 26 times has to be twice as good. Has to be!
but it sounds to me like you're proposing OTP with a weird way of generating the pad. So instead of saying t and z are needed to decrypt the message, I believe it would be fine to say that the pad is needed to decrypt the message. Well, yeah -- it's OTP so you need the pad. t and z are just a handy way of generating the pad any time you want it. You could just as easily use pi or e or whatever. I'm not certain, but I believe the pad should be derived from a source we consider to be truly random, not some function.
Ohg vg jnfa'g, jnf vg? Vg jnfa'g rira arneyl SC fgnghf. V zrna, sre pelvat bhg ybhq...
I chose a very poor example of t. In practise, t can cover a huge range of numbers. There is no shortage of methods of producing irrational numbers from rational numbers. eg e^a, sin(a), tan(a), sqrt(a), cubert(a) etc. With a being things like 1012758, or 2.3145753 or whatever.
I am probably wrong, but it feels like there would be too many t's and z's to chose from for it to be brute forceable. But another part of my intuition says I know jack shit about encryption and am 99.999% sure my method is easily breakable.
Depends on if Quantum Computers become practical in that timeframe. If they do, RSA (and a lot of other crypto algorithms) become useless.
Um, no.
From the Crypto Mini-FAQ:
Q: Will quantum computers make all this crypto obsolete?
Not in our lifetimes. Quantum cryptography along a single fiber optic
strand has been demonstrated, and claims to offer provable security
in a certain narrow academic sense, like the one-time pad. But to be
practical, it has to be combined with conventional cryptography, in
which case the quantum operations do not add much.
Quantum computers threaten the future of RSA in about the same way
that cold fusion threatens to solve the world's energy problems. It
would require huge theoretical and practical breakthroughs. Even if
that happens, people could just shift to AES-256 and other algorithms.
In the meantime, Moore's Law is a bigger threat to RSA.
"And if you have that secure channel, what's the point of the encryption? Why not just pass the plaintext over the secure channel?"
One example. You have a limited time frame in which you can exchange data over a secure channel (eg while you are in your home country). The OTP allows you to effectively extend the timeframe in which you can transmit securely.
this book is an ok reference, but not on the actual algorithms. it is more about implementation, and is not too mathematical, which is why people like it.
Don't forget Double-ROT13
Is "Applied Cryptography" the same book as the "Handbook on Applied Cryptography" that was posted on /. a couple of months ago. I am on chapter 5 of online version, and would hate to start all over again with this "Hands-on hands-down AC".
What I mean is this: is the post a dupe?
I believe it was Himler (probably a misspelling), but it was definately a high ranker in the Third Reich who said you can convince people anything with the word Patriot. This wave of nationalism is a very scary thing when you think about it from that view. Many people think we shouldn't question our president; Hitler's word was law. These are disconcerting parallels and I'm not saying I think Bush is the next Hitler, I'm just saying the nation is ripe for a police state and it's better to watch for such thing. Keep in mind no one believed the holocaust could happen before it did.
Ignorance kills, complacency kills, hatred kills, but usually not the ones guilty of them.
"Invaluable" appears once in the summary and three more times in the review.
And not only do we discover that "[t]he book pulls no punches", we later learn that "Ferguson and Schneier are refreshingly frank, too."
I would hope that a book outstrips the value of those which cost half the price or less, so is this really a complement?
May I suggest that you consider implementing your own.
The trivial way to implement the multiplcation of 2 numbers within a BN library takes O(n^2) as compared with the FFT which I believe is O(log(n)^2).
Now, the constant factor in the complexity of FFT is rather large as it requires a bit of work to set up. So if you are multipling numbers with a few digits, it would be faster to use the O(n^2), however, if you are doing really large number work go with the FFT algo.
You will note that I said "become practical within that timeframe" and "if they do, then . . ". I'm well aware of the breakthroughs required to make that happen.
Not a typewriter
One example. You have a limited time frame in which you can exchange data over a secure channel (eg while you are in your home country). The OTP allows you to effectively extend the timeframe in which you can transmit securely
Your example doesn't make sence. If you use a one-time-pad, you've only doubled the time frame (if you've recieved the OTP in the secure channel). It would make more sence to transmit a symetric key during the secure channel, and then use it to extend the time frame.
As far as you crypto system goes, you must ensure that 2 of your messages don't have overlapping sections of your generated numbers (ie you use your pad twice). If that happens, then it opens you up to the point that oscar only needs to do some simple statistical work, maybe even by hand (think venona).
From the table of contents of the book, it looks like it could be just another member of the Yarrow family.
Copyright Violation:"theft, piracy"::Anti-Trust Violation:"thermonuclear price terrorism"<-Overly dramatic language.
I've read about 1/3 of the book, and based upon that feel the book is worth recommending. Aside from the good points I'll mention below, my biggest problem with the book is lack of depth. I've been doing applied cryptography for over 15 years now, so I'm probably not the typical reader (I'm not a cryptographer in the formal sense, but I design protocols and use cryptographic constructs on a regular basis).
The writing is clear and does a good job of presenting information, and doing that well for a dense subject like cryptography should not be underestimated. The book is strongly opinionated, and I think that is a strength since the authors try [and for the most part succeed] in explaining how those opinions were formed. The topics are fairly comprehensive, and the material seems to be well organized (from what I've read so far).
For the knowledgeable, it is a bit disappointing. I did not expect to learn tons of new stuff, but was still disappointed at the depth. In many ways, the book was only a half-notch deeper than reading Schneier's Cryptogram essays, where perhaps I was hoping for something more like his papers. The good use of footnotes and references helps offset things a little.
There were clearly areas where the authors were more interested in than others, often corresponding to previous work (CTR block-cipher mode, PRNG). Other areas were less inspired, for example in the MAC (message-authentication-code) chapter they offer the advice "Do not output any of the intermediate values." This sounds good at first glance, but it totally impractical except under special circumstances (if the MAC routine allows variable length messages, and almost all do, intermediate values can be calculated by simply feeding the parts of the message into the routine - thus this advice has no real world value).
Another nitpick, is that I would have liked to see the various "rules" and advice formulated into check lists. That would have made the book much more valuable for crypto system designers, be they novice or expert.
On the balance, I feel that the book is worthwhile to anyone interested in the subject of cryptography, or who has to use [or design, test] a system that has cryptography. It won't make you an expert (funny how some people still think reading a book could do this), but at least it raises an awareness of the types of problems that derail cryptographic systems designs. It is easy to read and informative.
Your joke is therefore lame. QED.
It is Niels Ferguson, not Neils
if only the computer industry would adopt my schemefor data encoding, all this crypto stuff would become irrelevant.
I had missremembered the FFT complexity. I should have remembered that it is the same as sorting.
Your point is why I had included the complexity.