Network Security With Openssl

OpenSSL is a popular Open Source library that provides developers with an extensive collection of cryptographic functions for transmitting confidential information over the Internet. Because OpenSSL is the only non-commercial library that provides a free, commercial-quality implementation of SSL (a protocol developed by Netscape for transmitting data), this library is commonly used in free and open source Web site projects to protect a broad range of sensitive information such as credit card numbers and other financial transactions. This book documents the OpenSSL library, and provides a solid foundation for developers who have a need for cryptographic functions. Network Security with OpenSSL explains the important aspects of the OpenSSL API in detail and offers a series of practical examples and template code that developers can integrate into their own applications.

John Viega, Founder and Chief Scientist of Secure Software (www.securesoftware.com), is a well-known security expert, and coauthor of Building Secure Software (Addison-Wesley) and Network Security with OpenSSL (O'Reilly). John is responsible for numerous software security tools, and is the original author of Mailman, the GNU mailing list manager. He holds a B.A. and M.S. in Computer Science from the University of Virginia. Mr. Viega is also an Adjunct Professor of Computer Science at Virginia Tech (Blacksburg, VA) and a Senior Policy Researcher at the Cyberspace Policy Institute, and he serves on the Technical Advisory Board for the Open Web Applications Security Project. He also founded a Washington, D.C. area security interest group that conducts monthly lectures presented by leading experts in the field. He is the author or coauthor of nearly 80 technical publications, including numerous refereed research papers and trade articles.

Matt Messier, Director of Engineering at Secure Software, is a security authority who has been programming for nearly two decades. Besides coauthoring Network Security with OpenSSL, Matt coauthored the Safe C String Library, RATS, and EGADS, an Entropy Gathering and Distribution System used for securely seeding pseudo-random number generators. Prior to joining Secure Software, Matt worked for IBM and Lotus, on source and assembly level debugging techniques, and operating system concepts.

Pravir Chandra, Research Scientist at Secure Software Solutions, is an expert in language-level security. Most recently, he co-authored the DARPA-funded "catscan" tool for static security analysis of C source code. Pravir holds a B.S. in Computer Science from Case Western Reserve University, and wants you to know that Cleveland rocks!

Preface

ix

Introduction

1

(28)

Cryptography for the Rest of Us

2

(8)

Overview of SSL

10

(2)

Problems with SSL

12

(8)

What SSL Doesn't Do Well

20

(1)

OpenSSL Basics

21

(2)

Securing Third-Party Software

23

(6)

Command-Line Interface

29

(16)

The Basics

30

(2)

Message Digest Algorithms

32

(2)

Symmetric Ciphers

34

(1)

Public Key Cryptography

35

(5)

S/MIME

40

(2)

Passwords and Passphrases

42

(1)

Seeding the Pseudorandom Number Generator

43

(2)

Public Key Infrastructure (PKI)

45

(29)

Certificates

46

(9)

Obtaining a Certificate

55

(4)

Setting Up a Certification Authority

59

(15)

Support Infrastructure

74

(38)

Multithread Support

74

(7)

Internal Error Handling

81

(5)

Abstract Input/Output

86

(11)

Random Number Generation

97

(6)

Arbitrary Precision Math

103

(6)

Using Engines

109

(3)

SSL/TLS Programming

112

(59)

Programming with SSL

113

(37)

Advanced Programming with SSL

150

(21)

Symmetric Cryptography

171

(22)

Concepts in Symmetric Cryptography

171

(3)

Encrypting with the EVP API

174

(18)

General Recommendations

192

(1)

Hashes and MACs

193

(24)

Overview of Hashes and MACs

193

(2)

Hashing with the EVP API

195

(5)

Using MACs

200

(12)

Secure HTTP Cookies

212

(5)

Public Key Algorithms

217

(34)

When to Use Public Key Cryptography

218

(1)

Diffie-Hellman

219

(6)

Digital Signature Algorithm (DSA)

225

(5)

RSA

230

(6)

The EVP Public Key Interface

236

(8)

Encoding and Decoding Objects

244

(7)

OpenSSL in Other Languages

251

(24)

Net::SSLeay for Perl

251

(7)

M2Crypto for Python

258

(8)

OpenSSL Support in PHP

266

(9)

Advanced Programming Topics

275

(34)

Object Stacks

275

(2)

Configuration Files

277

(3)

X.509

280

(16)

PKCS#7 and S/MIME

296

(11)

PKCS#12

307

(2)

Appendix: Command-Line Reference

309

(44)

Index

353

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.

FREE SHIPPING

Amazon no longer offers textbook rentals. We do!

Network Security With Openssl

Summary

Author Biography

Table of Contents

Supplemental Materials