Network Security with OpenSSL: Cryptography for Secure Communications

by John Viega, Matt Messier, Pravir Chandra

Overview

Most applications these days are at least somewhat network aware, but how do you protect those applications against common network security threats? Many developers are turning to OpenSSL, an open source version of SSL/TLS, which is the most widely used protocol for secure network communications.The OpenSSL library is seeing widespread adoption for web sites that require cryptographic functions to protect a broad range of sensitive information, such as credit card numbers and other financial transactions. The library is the only free, full-featured SSL implementation for C and C++, and it can be used programmatically or from the command line to secure most TCP-based network protocols.Network Security with OpenSSL enables developers to use this protocol much more effectively. Traditionally, getting something simple done in OpenSSL could easily take weeks. This concise book gives you the guidance you need to avoid pitfalls, while allowing you to take advantage of the library's advanced features. And, instead of bogging you down in the technical details of how SSL works under the hood, this book provides only the information that is necessary to use OpenSSL safely and effectively. In step-by-step fashion, the book details the challenges in securing network communications, and shows you how to use OpenSSL tools to best meet those challenges.As a system or network administrator, you will benefit from the thorough treatment of the OpenSSL command-line interface, as well as from step-by-step directions for obtaining certificates and setting up your own certification authority. As a developer, you will further benefit from the in-depth discussions and examples of how to use OpenSSL in your own programs. Although OpenSSL is written in C, information on how to use OpenSSL with Perl, Python and PHP is also included.OpenSSL may well answer your need to protect sensitive data. If that's the case, Network Security with OpenSSL is the only guide available on the subject.

Product Details

ISBN-13:	9780596551971
Publisher:	O'Reilly Media, Incorporated
Publication date:	06/17/2002
Sold by:	Barnes & Noble
Format:	eBook
Pages:	386
File size:	3 MB

About the Author

John Viega, Founder and Chief Scientist of Secure Software (www.securesoftware.com), is a well-known security expert, and coauthor of Building Secure Software (Addison-Wesley) and Network Security with OpenSSL (O'Reilly). John is responsible for numerous software security tools, and is the original author of Mailman, the GNU mailing list manager. He holds a B.A. and M.S. in Computer Science from the University of Virginia. Mr. Viega is also an Adjunct Professor of Computer Science at Virginia Tech (Blacksburg, VA) and a Senior Policy Researcher at the Cyberspace Policy Institute, and he serves on the Technical Advisory Board for the Open Web Applications Security Project. He also founded a Washington, D.C. area security interest group that conducts monthly lectures presented by leading experts in the field. He is the author or coauthor of nearly 80 technical publications, including numerous refereed research papers and trade articles.

Matt Messier, Director of Engineering at Secure Software, is a security authority who has been programming for nearly two decades. Besides coauthoring Network Security with OpenSSL, Matt coauthored the Safe C String Library, RATS, and EGADS, an Entropy Gathering and Distribution System used for securely seeding pseudo-random number generators. Prior to joining Secure Software, Matt worked for IBM and Lotus, on source and assembly level debugging techniques, and operating system concepts.

Pravir Chandra, Research Scientist at Secure Software Solutions, is an expert in language-level security. Most recently, he co-authored the DARPA-funded "catscan" tool for static security analysis of C source code. Pravir holds a B.S. in Computer Science from Case Western Reserve University, and wants you to know that Cleveland rocks!

Table of Contents

	Preface	ix
1.	Introduction	1
	Cryptography for the Rest of Us	2
	Overview of SSL	10
	Problems with SSL	12
	What SSL Doesn't Do Well	20
	OpenSSL Basics	21
	Securing Third-Party Software	23
2.	Command-Line Interface	29
	The Basics	30
	Message Digest Algorithms	32
	Symmetric Ciphers	34
	Public Key Cryptography	35
	S/MIME	40
	Passwords and Passphrases	42
	Seeding the Pseudorandom Number Generator	43
3.	Public Key Infrastructure (PKI)	45
	Certificates	46
	Obtaining a Certificate	55
	Setting Up a Certification Authority	59
4.	Support Infrastructure	74
	Multithread Support	74
	Internal Error Handling	81
	Abstract Input/Output	86
	Random Number Generation	97
	Arbitrary Precision Math	103
	Using Engines	109
5.	SSL/TLS Programming	112
	Programming with SSL	113
	Advanced Programming with SSL	150
6.	Symmetric Cryptography	171
	Concepts in Symmetric Cryptography	171
	Encrypting with the EVP API	174
	General Recommendations	192
7.	Hashes and MACs	193
	Overview of Hashes and MACs	193
	Hashing with the EVP API	195
	Using MACs	200
	Secure HTTP Cookies	212
8.	Public Key Algorithms	217
	When to Use Public Key Cryptography	218
	Diffie-Hellman	219
	Digital Signature Algorithm (DSA)	225
	RSA	230
	The EVP Public Key Interface	236
	Encoding and Decoding Objects	244
9.	OpenSSL in Other Languages	251
	Net::SSLeay for Perl	251
	M2Crypto for Python	258
	OpenSSL Support in PHP	266
10.	Advanced Programming Topics	275
	Object Stacks	275
	Configuration Files	277
	X. 509	280
	PKCS#7 and S/MIME	296
	PKCS#12	307
Appendix	Command-Line Reference	309
	Index	353