Applied Cryptography: Protocols, Algorithms, and Source Code in C, Second Edition

A caveat: this is not a textbook of cryptography in the sense that it teaches everything necessary to understand the mathematical basis of the science. Schneier does not discuss number theory because he expects those who use the relevant chapters of the book will already have training in higher maths. Nonetheless, the book does contain a wealth of information even for the layman.

One helpful part of Schneier's book is his opinion of which encryption algorithms are already broken by the National Security Agency, thus letting the reader know which encryption programs to avoid. There will always be people who encrypt to 40-bit DES even though it is flimsy and nearly instantly breakable, but the readers of APPLIED CRYPTOGRAPHY can greatly improve the confidentiality of their messages and data with this book. Discussion of public-key web-of-trust is essential reading for anyone confused by how public-key signatures work.

APPLIED CRYPTOGRAPHY was published in 1995 and some parts are already out of date. It is ironic that he hardly mentions PGP, when PGP went on to become the most renowned military-strength encryption program available to the public, although it is being superseded by GnuPG. Another anachronism is Schneier's assurance that quantum computing is decades away. In the years since publication of APPLIED CRYPTOGRAPHY we have seen some strides in quantum computer, even the creation of a quantum computer that can factor the number 15. While this publicly known quantum computer is not at all anything to get excited about, it is certain that more powerful quantum computers are in development and classified by NSA. Because a quantum computer can break virtually any traditional cipher, hiding the message (steganography) is becoming more important than ever. In the era of Schneier's book steganography was unnecessary because ciphertext could withstand brute-force attacks, but with advances in computing power steganography is becoming vital to secure communications. It would be nice to see the book updated with this topic, because cryptography and steganography can no longer be regarded as two distinct fields.

All in all, in spite of its age, APPLIED CRYPTOGRAPHY is recommended to anyone interested in cryptography. It ranks among the essential books on the field, although an updated version is certainly hoped for.


A must have for anyone involved with encryption & security   November 27, 2000
Ben Rothke (USA)
44 out of 49 found this review helpful

Applied Cryptography is quite simply the quintessential guidebook for information about cryptography. It also is one of the finest computer security books ever written. Bruce Schneier is a cryptologist who has a passion for cryptography, and it shows in his masterpiece. Instant classic is an often used oxymoron, yet that term is most appropriate to describe Applied Cryptography. If you have any interest with security and encryption, Applied Cryptography is clearly the definitive publication to reference and the most comprehensive text available about security and encryption. It might sound as if via my high praise for this book that I am getting some type of endorsement, that is not the case. It is just that Applied Cryptography is quite simply the most comprehensive, up-to-date work about cryptography.

The vast array of topics covered by the book is truly astounding in is depth and breadth. There is hardly a single cryptological concept, either minor or major, that the book does not cover. It is not possible to detail everything Applied Cryptography covers. But a few of the topics are: Foundations of cryptography, Protocols, Protocol Building Blocks, Key Lengths, key exchange, key management, Algorithms, the mathematical of cryptography, DES, RSA, One-Way Hash Functions, Symmetric vs. Public-Key cryptography, Public-Key Digital Signature Algorithms, Substitution Ciphers and Transposition Ciphers, Digital Signatures, Random and Pseudo-Random Sequence Generation, PGP, Authentication, Advanced security Protocols, Cryptographic Techniques, Identification Schemes, the politics of cryptography and much (much!) more.

Applied Cryptography also includes the source code for DES, IDEA, BLOWFISH, RC5 and other algorithms. It even covers encryption algorithms from the former Soviet Union, including GOST.

The magnificence of Applied Cryptography is that Schneier is able to take very complex, abstract ideas and express them in an extremely comprehensible manner. Applied Cryptography therefore lacks the dryness that plagues a lot of textbooks. Schneier is able to take both theoretical and academic ideas, and mold them into practical real-world intelligible book. All in all, Applied Cryptography makes for some very enjoyable and occasionally humorous reading.

One thing I really liked about Applied Cryptography is its index. Rather than using the traditional cumbersome citations such as RIV92b or GOL88 that often take a while to locate, Schneier simply uses numbers. In light that he references over 1600 sources, it makes looking up the sources an incredible time saver. What is extremely impressive about Applied Cryptography is that Schneier quotes from every imaginable source. From general security periodicals, scholarly academic journals, conference proceedings, government publications and official standards, Schneier has been there.

Schneier writes at length about whether a crypto customer should choose an algorithm for that is publicly published algorithm (i.e., DES, RSA, Blowfish) or to use a proprietary algorithm that belongs to a specific manufacturer. With a proprietary algorithm, Schneier writes that it is impossible to determine how truly secure the algorithm is, given that the owners do not generally make their code available for open inspection. There is even the possibility that the manufacturer (or government, if under federal contract) has put in a back door into the algorithm. Schneier states that: "Putting your trust in a single manufacturer, consultant, or government is asking for trouble. The NSA has some of the world's best cryptographers working for it, but it is hard to know if they're telling you all you know."

This idea then segues into the (in)famous Clipper chip and concept of key escrow. As a world class cryptographer, Schneier has major issues with the concept of Clipper, calling it "Orwellian" Schneier feels that encryption is too important to be left to the government and Clipper advances the power of the government over the right of the people.

In conclusion, Applied Cryptography is a must have book for anyone involved with encryption and security.


Essential reference for any programmer   July 14, 2004
wiredweird (Earth, or somewhere nearby)
13 out of 15 found this review helpful

Over the long term, this is the applied math book that I come back to most often.

The first quarter of the book may come as a surprise. It's not about encryption, it's about secure protocols. This is great stuff. It includes secure key exchange, where you and I can agree on an encryption key in a public conversation, but none of the other listeners know what we agreed on. It includes zero-knowledge proofs, ways of establishing authorization without releasing your identity. It includes lots more, as well. The next brief section discusses different modes for using encryption algorithms, key management, and other logistics.

The third section is what you might have expected: detailed descriptions of many encryption schemes, taking up at least half the book. That includes public key schemes, private key codes, secure hashing algorithms, and all the other details needed for implementing the algorithms. One of the most useful subsections here is a set of pseudorandom number generators. It's not exhaustive, by any means - it omits the Mersenne Twister, for example. Still, it gives a fair set of algorithms, some of which are "cryptographically secure". That means the generator's output strongly resists attempts to find regularities, just the way a truly random sequence would.

The last two chapters give a brief summary of the practice, legalities, and even culture around cryptography.

This won't make you into a crypto professional. Despite its 600+ pages, it barely introduces the world of crypto and certainly doesn't release anything from the "closed" world of government agencies. It will, however, give you useful algorithms, a basic background, and an appreciation of just what real crypto is about. That last may be the most important part. Too many people think inventing a good code is like making love: anyone can do it, and they instinctively do it better than most people. Wrong! Real crypto is not for dabblers, and this book gives some sense of what is involved.

The first edition of "Applied Cryptography" was a landmark text, but the second edition is even better. It's so much better that, if you just have the first edition, you really should upgrade to the second, and I've never said that about any other book.


Excellent Text - Not Too Mathematical   August 26, 2004
Stuart Gardner (Fair Lawn, NJ)
5 out of 6 found this review helpful

This book provides excellent coverage of the mayor cryptography algorithms. It is a must have (for academic study or implementation), if only for the completeness of coverage and the comprehensive references. The C code provided is adequate, but reasonable programming skills are assumed. The book is not overly mathematical (which many of the other cryptography texts are - this is great for me, as I am more intereseted in practice). There is also good information on assessing / comparing the merits of different algorithms. Great for the practictioner or student taking a first course (it's still not bedtime reading). Mathematicians will look for more ......


I never though Cryptography could be so easy to understand   August 1, 2003
T. C Gerlach (Altoona, PA United States)
3 out of 4 found this review helpful

Mr. Schneier does a beautiful job of making the most complex topics of cryptography easy to understand. His examples and explanations brilliantly explain the topics. This book is actually a very interesting approach to something that at first glance would appear dull and dry. There are plenty of charts and diagrams, as well as the source code for popular encryption algorithms. These visuals, and the accompanying text have really aided me in understanding cryptography. I would recommend this book to anyone wanting to have a better understanding of cryptography.

Great job Mr. Schneier.