密码工程

Hacker News 上怎么说

• tptacek · 2013 年

  《Applied Cryptography》作为参考书简直糟糕透顶。请别再向程序员推荐它了。相反，推荐《Practical Cryptography》/《Cryptography Engineering》（其实是同一本书），那是 Schneier 和 Niels Ferguson 合著的。更新：我之前说了“烂书”，不过我得说得更严谨些。它不是一本烂“书”；读起来我其实挺……

  Applied Cryptography is a terrible reference. Please don't recommend it to programmers. Instead, recommend Practical Cryptography / Cryptography Engineering (they're the same book), which Schneier co-authored with Niels Fergusen. Update: I said "terrible book" but I'm going to start being more precise about this. It's not a terrible "book"; I enjoyed the…

• sillysaurus3 · 2014 年

  ……的话，你就不需要推翻重学任何东西，所以你反而省事得多。”来源：http://wiki.securityweekly.com/wiki/index.php/Episode292 时间节点 22:10，不过整期播客都很不错。相反，他推荐的是《Cryptography Engineering》：http://www.amazon.com/Cryptography-Engineering-Principles-Pr... 另一个密码学入门的方法是做 Matasano crypto challenges：http://cryptopals.com/ 答案目前还没（公开？）发布，……

  …it, you have nothing to unlearn, so you're much better off." Source: http://wiki.securityweekly.com/wiki/index.php/Episode292 time index 22:10, but the whole podcast is good. Instead, he recommends Cryptography Engineering: http://www.amazon.com/Cryptography-Engineering-Principles-Pr... Another way to get a primer on crypto is to do the Matasano crypto challenges: http://cryptopals.com/ The solutions aren't (yet?) published,…

• garrettr_ · 2017 年

  ……密钥的熵，从 256 bits 掉到了约 190 bits（log2(62^32)）。而且这还是在最好情况下，假定它是从分布中均匀采样的——然而并不是。我建议读读《Cryptography Engineering》[1] 的第 9.7 节，了解一下为什么从集合中随机选取元素远比看起来要难。类似 bug 的一个典型例子是 2013 年 Cryptocat 的 PRNG 里的那个恶性 bug [2]。我推测这一步是为了让……

  …of the key, from 256 bits of entropy to ~190 bits (log2(62^32)). And that would be in the best case, if it were sampling uniformly from the distribution - it is not. I recommend reading Section 9.7 of Cryptography Engineering [1] to understand why choosing random elements from a set is harder than it seems. A good example of a similar bug is the nasty bug in Cryptocat's PRNG from 2013 [2]. I assume this step was done so the…

• TallGuyShort · 2017 年

  针对这个问题，比起《Applied Cryptography》，我更推荐 Schneier 的《Cryptography Engineering》（或者它的前身《Practical Cryptography》）。我承认《Applied Cryptography》是一本非常有趣的书，但这只是因为我是个 crypto nerd。对于想找……

  I would recommend Schneier's Cryptography Engineering (or its predecessor) Practical Cryptography over Applied Cryptography, given the question. I agree Applied Cryptography is a very interesting book, but that's because I'm a crypto nerd. For someone looking…

• marshray · 2011 年

  那本书太老了，虽然大体上仍然正确，但想要学习构建安全系统的实践，有更好的途径。我推荐 Ferguson、Schneier 和 Kohno 写的《Cryptography Engineering》，它是 Schneier 的 AC 更加现代的后继之作。

  That book is old, and though still basically correct, there's much better ways to learn about the practice of developing secure systems. I recommend "Cryptography Engineering" by Ferguson, Schneier, Kohno which is a more modern descendant of Schneier's AC.

• nbpoole · 2013 年

  我觉得 tptacek 的意思是，你问题的答案在那个页面上已经写得清清楚楚了。;-) 页面上写道：> 你应该去买一本 Ferguson 和 Schneier 的后继作品《Cryptography Engineering》（C.E.）。部分出于赎罪的心态，这本新书熟练地处理了旧作中绊倒读者的地方。C.E. 旨在教你正确应用密码学的方法，而不用把时间浪费在 GOST 和 El……

  I think tptacek's point is that the answer to your question is spelled out very clearly on the page. ;-) From the page: > You should own Ferguson and Schneier’s follow-up, Cryptography Engineering (C.E.). Written partly in penance, the new book deftly handles material the older book stumbles over. C.E. wants to teach you the right way to work with cryptography without wasting time on GOST and El…

正在加载完整评论……