رمزنگاری عملی در پایتون: یادگیری رمزنگاری صحیح با مثال‌ها

Table of Contents About the Authors About the Technical Reviewer Introduction Chapter 1: Cryptography: More Than Secrecy Setting Up Your Python Environment Caesar’s Shifty Cipher A Gentle Introduction to Cryptography Uses of Cryptography What Could Go Wrong? YANAC: You Are Not A Cryptographer “Jump Off This Cliff”—The Internet The cryptodoneright.org Project Enough Talk, Let’s Sum Up Onward Chapter 2: Hashing Hash Liberally with hashlib Making a Hash of Education Preimage Resistance Byte into Some Non-negative Integers How Hard a Hash! Second-Preimage and Collision Resistance Second-Preimage Resistance Collision Resistance Digestible Hash Pass Hashwords...Er...Hash Passwords Pick Perfect Parameters Cracking Weak Passwords Proof of Work Time to Rehash Chapter 3: Symmetric Encryption: Two Sides, One Key Let’s Scramble! What Is Encryption, Really? AES: A Symmetric Block Cipher ECB Is Not for Me Wanted: Spontaneous Independence Not That Blockchain Proper Padding A Key to Hygienic IVs Cross the Streams Key and IV Management Exploiting Malleability Gaze into the Padding Weak Keys, Bad Management Other Encryption Algorithms finalize() Chapter 4: Asymmetric Encryption: Public/Private Keys A Tale of Two Keys Getting Keyed Up RSA Done Wrong: Part One Stuffing the Outbox What Makes Asymmetric Encryption Different? Pass the Padding Deterministic Outputs Chosen Ciphertext Attack Common Modulus Attack The Proof Is in the Padding Exploiting RSA Encryption with PKCS #1 v1.5 Padding Step 1: Blinding Step 2: Searching for PKCS-Conforming Messages Step 3: Narrowing the Set of Solutions Step 4: Computing the Solution Additional Notes About RSA Key Management Algorithm Parameters Quantum Cryptography Really Short Addendum Chapter 5: Message Integrity, Signatures, and Certificates An Overly Simplistic Message Authentication Code (MAC) MAC, HMAC, and CBC-MAC HMAC CBC-MAC Encrypting and MACing Digital Signatures: Authentication and Integrity Elliptic Curves: An Alternative to RSA Certificates: Proving Ownership of Public Keys Certificates and Trust Revocation and Private Key Protection Replay Attacks Summarize-Then-MAC Chapter 6: Combining Asymmetric and Symmetric Algorithms Exchange AES Keys with RSA Asymmetric and Symmetric: Like Chocolate and Peanut Butter Measuring RSA’s Relative Performance Diffie-Hellman and Key Agreement Diffie-Hellman and Forward Secrecy Challenge-Response Protocols Common Problems An Unfortunate Example of Asymmetric and Symmetric Harmony That’s a Wrap Chapter 7: More Symmetric Crypto: Authenticated Encryption and Kerberos AES-GCM AES-GCM Details and Nuances Other AEAD Algorithms Working the Network An Introduction to Kerberos Additional Data Chapter 8: TLS Communications Intercepting Traffic Digital Identities: X.509 Certificates X.509 Fields Certificate Signing Requests Generate a Key Create a CSR from a Key Signing a CSR to Produce a Certificate Creating Keys, CSRs, and Certificates in Python An Overview of TLS 1.2 and 1.3 The Introductory “Hellos” Client Authentication Deriving Session Keys Switching to the New Cipher Deriving Keys and Bulk Data Transfer TLS 1.3 Certificate Verification and Trusting Trust Certificate Revocation Untrustworthy Roots, Pinning, and Certificate Transparency Known Attacks Against TLS POODLE FREAK and Logjam Sweet32 ROBOT CRIME, TIME, and BREACH Heartbleed Using OpenSSL with Python for TLS The End of the Beginning Bibliography Index Develop a greater intuition for the proper use of cryptography. This book teaches the basics of writing cryptographic algorithms in Python, demystifies cryptographic internals, and demonstrates common ways cryptography is used incorrectly. Cryptography is the lifeblood of the digital world’s security infrastructure. From governments around the world to the average consumer, most communications are protected in some form or another by cryptography. These days, even Google searches are encrypted. Despite its ubiquity, cryptography is easy to misconfigure, misuse, and misunderstand. Developers building cryptographic operations into their applications are not typically experts in the subject, and may not fully grasp the implication of different algorithms, modes, and other parameters. The concepts in this book are largely taught by example, including incorrect uses of cryptography and how "bad" cryptography can be broken. By digging into the guts of cryptography, you can experience what works, what doesn't, and why. What You’ll Learn • Understand where cryptography is used, why, and how it gets misused • Know what secure hashing is used for and its basic properties • Get up to speed on algorithms and modes for block ciphers such as AES, and see how bad configurations break • Use message integrity and/or digital signatures to protect messages • Utilize modern symmetric ciphers such as AES-GCM and CHACHA • Practice the basics of public key cryptography, including ECDSA signatures • Discover how RSA encryption can be broken if insecure padding is used • Employ TLS connections for secure communications • Find out how certificates work and modern improvements such as certificate pinning and certificate transparency (CT) logs Who This Book Is For IT administrators and software developers familiar with Python. Although readers may have some knowledge of cryptography, the book assumes that the reader is starting from scratch. Develop a greater intuition for the proper use of cryptography. This book teaches the basics of writing cryptographic algorithms in Python, demystifies cryptographic internals, and demonstrates common ways cryptography is used incorrectly. Cryptography is the life blood of the digital world's security infrastructure. From governments around the world to the average consumer, most communications are protected in some form or another by cryptography. These days, even Google searches are encrypted. Despite its ubiquity, cryptography is easy to misconfigure, misuse, and misunderstand. Developers building cryptographic operations into their applications are not typically experts in the subject, and may not fully grasp the implication of different algorithms, modes, and other parameters. The concepts in this book are largely taught by example, including incorrect uses of cryptography and how "bad" cryptography can be broken. By digging into the guts of cryptography, you can experience what works, what doesn't, and why. What You'll Learn: Understand where cryptography is used, why, and how it gets misused Know what secure hashing is used for and its basic properties Get up to speed on algorithms and modes for block ciphers such as AES, and see how bad configurations break Use message integrity and/or digital signatures to protect messages Utilize modern symmetric ciphers such as AES-GCM and CHACHA Practice the basics of public key cryptography, including ECDSA signatures Discover how RSA encryption can be broken if insecure padding is used Employ TLS connections for secure communications Find out how certificates work and modern improvements such as certificate pinning and certificate transparency (CT) logs