Book Description
This digital document is a journal article from Digital Investigation, published by Elsevier in 2006. The article is delivered in HTML format and is available in your Amazon.com Media Library immediately after purchase. You can view it with any web browser.

Description:
Hashing is a fundamental tool in digital forensic analysis used both to ensure data integrity and to efficiently identify known data objects. However, despite many years of practice, its basic use has advanced little. Our objective is to leverage advanced hashing techniques in order to improve the efficiency and scalability of digital forensic analysis. Specifically, we explore the use of Bloom filters as a means to efficiently aggregate and search hashing information. In this paper, we present md5bloom-an actual Bloom filter manipulation tool that can be incorporated into forensic practice, along with example uses and experimental results. We also provide a basic theoretical foundation, which quantifies the error rates associated with the various Bloom filter uses along with a simulation-based verification. We provide a probabilistic framework that allows the interpretation of direct, bitwise comparison of Bloom filters to infer similarity and abnormality. Using the similarity interpretation, it is possible to efficiently identify versions of a known object, whereas the notion of abnormality could aid in identifying tampered hash sets. ... Read more

Book Description
Learn to Use the Right Cryptography Library Everytime!No longer is it an option for software to include cryptography; everyone from office suites to accounting software and eCommerce Web sites use it. So today's developers have to know how to write software that includes cryptographic functionality. Although they are usually familiar with the basics of cryptography, they are not always familiar enough with the available products to select the right API/library and get up and running with it quickly. Cryptographic Libraries for Developers teaches developers about the available APIs and helps them select the right ones for their projects based on platform, language, and regulatory requirements. The book serves as a nuts and bolts guide to writing software using these libraries and provides abundant examples and detailed examples throughout. The libraries covered include OpenSSL, B/Safe, the Java Cryptographic Library (JCE,) as sign/verify, encrypt/decrypt (asymmetric and symmetric,) MACs, and Hashing, as well as higher-level primitives such as X.509 digital certificates and secure (SSL) communications. ... Read more

Customer Reviews (3)

How to write and deploy cryotography applications
Ed Moyle and Diana Kelley's CRYPTOGRAPHIC LIBRARIES FOR DEVELOPERS is a winning guide for developers seeking a tutorial on how to write and deploy applications requiring cryptography. The five common cryptography libraries are surveyed in a title which teaches which ones are best for different projects based on platform, language and regulatory requirements, offering software writers plenty of examples and explanations.

Fills a needed niche, but lacks details for the curious
This book is neither a security book nor is it a cryptography book. Instead it is a book for programmers who want to use available APIs to add security and cryptography to the code they are writing without having to actually learn cryptography. Thus, it is assumed that the reader is proficient in C, C++, or Java programming, depending upon which cryptography API you are planning to employ. The authors spend the first part of the book going over what I consider to be a very bare outline of cryptography techniques and development goals for cryptographic code. They spend the second half of the book talking about specific cryptographic API's and how to program cryptographic solutions using each of these API's. The API's covered are OpenSSL, CryptoAPI (CAPI), JCA/JCE (Java Cryptography API), and BSAFE. Each API has its own chapter that contains an API overview and code examples. The book's grand finale is a chapter on applications that shows how to build a multilibrary cryptographic interface in C++, and also how to perform file content protection in C++.
The authors say that their goal is to shave development time for working programmers, and in that goal they succeed. However, it is very hard to succeed at a task by rote learning, and this book on cryptographic programming without any of the pesky but interesting mathematical details just left me wanting more. If you want a couple of good books on cryptography and network security themselves might I recommend "Cryptography and Network Security (4th Edition)" by Stallings, and also "Applied Cryptography" by Schneier. Stallings' book was only recently published, is very easy to read, and covers both subjects comprehensively in an accessible style. Schneier's book is starting to age, yet is still the definitive text for programmers who are interested in cryptographic algorithms.
I notice that Amazon does not show the table of contents for this book, so I do that here:
1. Introduction
2. Security Concepts- Developer Overview
3. Cryptographic Engineering
4. Basic Techniques
5. Implementation Choices
6. Application Development Strategies
7. Developing with OpenSSL
8. Developing with CAPI
9. Developing with JCA/JCE
10. Developing with BSAFE
11. Example Applications

Making an Impossible Task Manageable
When we think of cryptography we normally think back to the codes broken during World War II, of Enigma, Magic and Purple. Today when I bought an item from e-Bay I thought nothing about putting in my credit card information because I had faith that the card number wouldn't been seen by any of the bad guys. ==We use words like 'secure transaction' and 'SSL' to tell people that sending such information is at little or no risk to them. We rarely stop to think that the reason sending this information is safe is cryptography.

At the user level, cryptography has become invisible to the ordinary operation of the web. At the serious end of cryptography, it is still an arcane world of advanced math and carefully designed and tested algorythms. This book is aimed at the application developer level, where you and I might be wanting to ensure the safe and private transmission of data, but where we don't want to get down into the heavy math.

Enter standard libraries of cryptographic routines to enable the use of very advanced techniques in standard applications code. That's the focus of this book. It investigates and describes the various libraries that are available for the safe transmission of data. These libraries make what would be an all but impossible task easily manageable. ... Read more

Book Description
This digital document is a journal article from Digital Investigation, published by Elsevier in 2006. The article is delivered in HTML format and is available in your Amazon.com Media Library immediately after purchase. You can view it with any web browser.

Description:
The National Software Reference Library (NSRL) provides a repository of known software, file profiles, and file signatures for use by law enforcement and other organizations involved with computer forensic investigations. During a forensic investigation, hundreds of thousands of files may be encountered. The NSRL is used to identify known files. This can reduce the amount of time spent examining a computer. Matches for common operating systems and applications do not need to be searched, either manually or electronically, for evidence. Additionally, the NSRL is used to determine which software applications are present on a system. This may suggest how the computer was being used and provide information on how and where to search for evidence. This paper examines whether the techniques used to create file signatures in the NSRL produce unique results-a core characteristic that the NSRL depends on for the majority of its uses. The uniqueness of the file identification is analyzed via two methods: an empirical analysis of the file signatures within the NSRL and research into the recent attacks on the hash algorithms used to generate the file signatures within the NSRL. ... Read more

Book Description
This digital document is a journal article from Information Systems, published by Elsevier in 2006. The article is delivered in HTML format and is available in your Amazon.com Media Library immediately after purchase. You can view it with any web browser.

Description:
Documents are co-derivative if they share content: for two documents to be co-derived, some portion of one must be derived from the other, or some portion of both must be derived from a third document. An existing technique for concurrently detecting all co-derivatives in a collection is document fingerprinting, which matches documents based on the hash values of selected document subsequences, or chunks. Fingerprinting is hampered by an inability to accurately isolate information that is useful in identifying co-derivatives. In this paper we present spex, a novel hash-based algorithm for extracting duplicated chunks from a document collection. We discuss how information about shared chunks can be used for efficiently and reliably identifying co-derivative clusters, and describe deco, a prototype package that combines the spex algorithm with other optimisations and compressed indexing to produce a flexible and scalable co-derivative discovery system. Our experiments with multi-gigabyte document collections demonstrate the effectiveness of the approach. ... Read more

Book Description

This book constitutes the refereed proceedings of the Fifth Theory of Cryptography Conference, TCC 2008, held in New York, USA, March 19-21, 2008.

Book Description

This book presents modern concepts of computer security. It introduces the basic mathematical background necessary to follow computer security concepts. Modern developments in cryptography are examined, starting from private-key and public-key encryption, going through hashing, digital signatures, authentication, secret sharing, group-oriented cryptography, pseudorandomness, key establishment protocols, zero-knowledge protocols, and identification, and finishing with an introduction to modern e-business systems based on digital cash. Intrusion detection and access control provide examples of security systems implemented as a part of operating system. Database and network security is also discussed.