.NET Security and Cryptography

Peter Thorsteinson, G. Gnana Arun Ganesh

.NET Security and Cryptography
  • 出版商: Prentice Hall
  • 出版日期: 2003-08-28
  • 售價: $2,170
  • 貴賓價: 9.5 折 $2,062
  • 語言: 英文
  • 頁數: 496
  • 裝訂: Paperback
  • ISBN: 013100851X
  • ISBN-13: 9780131008519
  • 相關分類: .NET、資訊安全

    • 已過版

買這商品的人也買了...

相關主題

商品描述

Summary

Learn how to make your .NET applications secure!

Security and cryptography, while always an essential part of the computing industry, have seen their importance increase greatly in the last several years. Microsoft's .NET Framework provides developers with a powerful new set of tools to make their applications secure. NET Security and Cryptography is a practical and comprehensive guide to implementing both the security and the cryptography features found in the .NET platform. The authors provide numerous clear and focused examples in both C# and Visual Basic .NET, as well as detailed commentary on how the code works. They cover topics in a logical sequence and context, where they are most relevant and most easily understood. All of the sample code is available online at <www.objectinnovations.com/library/books/books_dotnet.html>.

This book will allow developers to:

  • Develop a solid basis in the theory of cryptography, so they can understand how the security tools in the .NET Framework function
  • Learn to use symmetric algorithms, asymmetric algorithms, and digital signatures
  • Master both traditional encryption programming as well as the new techniques of XML encryption and XML signatures
  • Learn how these tools apply to ASP.NET and Web Services security

Table of Contents

Preface.


Acknowledgments.


About This Series.


1. NET Cryptography and Security.

The Nature of This Book. Risks Are Everywhere. The Nature of Cryptography and Security. Why Cryptography and Security Are Important. What Cryptography and Security Can and Cannot Do. Windows Security Comes of Age. The .NET Framework and the CLR. How the .NET Framework Simplifies Security. Reliability and the .NET Platform. Managed Code and Type Safety. .NET Cryptography Programming. .NET Security Programming. Role-Based Security and Principals. CAS, Evidence, Policy, and Permissions. Summary.



2. Fundamentals of Cryptography.

Security and Keeping Secrets. Basic Cryptographic Terminology. Secret Keys Versus Secret Algorithms. Classical Techniques for Keeping Secrets. Brute-Force Attack Work Factor. Arbitrary Precision Arithmetic. Steganography. Modern Ciphers. Cryptography and the .NET Framework. Symmetric Cryptography. Asymmetric Cryptography. Cryptographic Algorithms. Cryptographic Protocols. Cryptanalytic Attacks. Issues in Human Interaction and Trust. Risk and Benefit. Other Important Concepts. Summary.



3. Symmetric Cryptography.

Symmetric Ciphers. DES. Modes of Operation. Triple DES. Rijndael. RC2. Programming with .NET Symmetric Cryptography. The Main Cryptography Classes. The SymmetricAlgorithm Class. SymmetricAlgorithm-Derived Classes. The SymmetricAlgorithms Example. Cryptographic Streams. Avoiding Weak Keys. Key Exchange Issues. Encrypted Hash Codes and Message Integrity. Keyed Hash Functions and Message Integrity. Summary.



4. Asymmetric Cryptography.

Problems with Symmetric Algorithms. The Key Exchange Problem. The Trust Problem. The Idea Behind Asymmetric Cryptography. Using Asymmetric Cryptography. The Combination Lock Analogy. Trapdoor One-Way Functions. Advantages of the Asymmetric Approach. Combining Asymmetric and Symmetric Algorithms. Existing Asymmetric Algorithms. RSA: The Most Used Asymmetric Algorithm. Underpinnings of RSA. A Miniature RSA Example. Caveat: Provability Issues. Programming with .NET Asymmetric Cryptography. An RSA Algorithm Example. Saving Keys as XML. Digital Certificates. Summary.



5. Digital Signatures.

Hash Algorithms. Good Hash Function Characteristics. Hash Algorithms Provided by .NET. The HashAlgorithm Class. The MD5 and SHA Classes. The KeyedHashAlgorithm Class. Object Identifiers. How Digital Signatures Work. RSA Used as a Digital Signature Algorithm. An RSA Signature Example Program. The Digital Signature Algorithm. Some Mathematical Background: Group Theory. The Discrete Logarithm Problem. How DSA Works. The Asymmetric AlgorithmHierarchy Class Hierarchy. The DSACryptoServiceProvider Class. A DSA Programming Example. Summary.



6. XML Cryptography.

XML Encryption. XML Encryption Versus SSL/TLS. The XML Encryption Specification. What XML Encryption Provides. XML Encryption Syntax. How XML Encryption Works. Classes Used in XML Encryption. Communicating Asymmetric Key Information. The XmlEncryption Example. XML Signatures. The XML Signature Specification. What XML Signatures Provide. XML Signature Syntax. Classes Used in XML Signatures. The EnvelopingXmlSignature Example. Combining XML Signing and XML Encryption. Summary.



7. NET User-Based Security.

Authentication and Authorization. .NET Security Model. Administrating Windows Security. Defining Users and Roles on Windows. Defining Shared Folder Permissions on Windows. Defining NTFS Security on Windows. Administrating .NET Security. Permissions. The IPermission Interface. The IPermission Inheritance Hierarchy. The PrincipalPermission Class. User-Based Security. Principal and Identity Objects. The IIdentity Interface. IIdentity Implementation Classes. The GenericIdentity Class. The WindowsIdentity Class. Principal Objects. The IPrincipal Interface. The GenericPrincipal Class. The WindowsPrincipal Class. Two Approaches to User-Based Security. Imperative User-Based Security. Declarative User-Based Security. Credentials. Network Credentials. Security Discipline. Principle of Least Privilege. Establish Security Policy Early. Summary.



8. NET Code Access Security.

The Need for Code Access Security. Cost Versus Risk. The Range of Risks. Assembly Trustworthiness. Risks of Calling into Unmanaged Code. Security, Managed Code, and the CLR. Microsoft Intermediate Language. Verifiably Type-Safe Code. Denying and Demanding Permissions. How CAS Is Used. Flexible Security. The Luring Attack and Walking the Stack. Managing Security Policy with Code Groups. The Basic Concepts of Security Policy Management. Using the .NET Framework Configuration Tool. Using the Caspol.exe Utility. Imperative Versus Declarative CAS. Evidence-Based Security. The Evidence Class. Obtaining the Current Application Domain Evidence. Enumerating Evidence. The WalkingThruEvidence Example. Accessing the WalkingThruEvidence Example Via IIS. Imperative CAS. Code Access Permissions. CodeAccessPermission Derived Classes. The CodeAccessPermission Class. The UrlIdentityPermission Class. Working with Code Access Permissions. Declarative Code Access Permissions. Square Bracket Attribute Declaration Syntax. The URL Identity Permission Attribute. The SecurityAction Class. Permission Requests. The PermissionRequest Example. Permission Sets. The PermissionSet Class. Defining a Permission Set in a Configuration File. Summary.



9. ASP.NET Security.

Fundamental Security Mechanisms. Authentication: Who Are You? Authorization: Are You Allowed to Access This Resource? Impersonation: Application Assumes Client's Identity. Implementing ASP.NET Authentication. ASP.NET Configuration. Facts and Benefits of the ASP.NET Configuration System. Configuration Hierarchy. Description. Forms Authentication. Method 1: Storing Credentials in the Web.config File. Method 2: Storing Credentials in the XML File. The Users.xml File. The login.aspx File. Method 3: Storing Credentials in a Database. Forms Authentication Classes. Passport Authentication. Windows Authentication. Implementing ASP.NET Authorization. File Authorization. URL Authorization. Implementing ASP.NET Impersonation. Summary.



10. Web Services Security.

Basic Techniques in Securing Web Services. Secure Connection. Authentication and Authorization. Authentication Mechanisms for HTTP. Authenticate Web Service Using SOAPHEADER. The SOAP Message Architecture. Creating a Proxy with Visual Studio .NET. XML Security Technologies. Integrity. XML Signature. Data Protection and Privacy. XML Encryption. XML Key Management Specification (XKMS). Security Assertion Markup Lanquage (SAML). Global XML Web Services Architecture (GXA). WS-Security. WS Initial Specifications. Next Steps of Specifications. Why WS-Security? Security Token Propagation. Message Integrity. Message Confidentiality. Organizations Involved. Summary.



A. A Security Attack Example: The Stack Overrun.


B. How the RSA Cipher Works.

Modular Arithmetic. The BigRSA Example Program. The CrackRSAWorkFactorDemo Example Program.



C. Using the GNU GMP Library.

Installing Cygwin. Testing Your Cygwin Installation. Installing GMP. Uninstalling Cygwin.



D. Cryptography and Security Resources.

Background Knowledge and Conceptual Books. Cryptographic Mathematics Books. Implementing Security Guide Books. Human Interest Books on Cryptography. Cryptography News Groups. Useful Cryptographic and Security Web Sites.



E. Exploring Web Services.

Motivation for Web Services. Web Services Definition. Backbones of Web Services. Next Generation of Distributed Computing: Web Services. Benefits of Web Services. ASP.NET Web Services. Web Services Architecture. Code Model for Web Services. Developing a Simple Concatenate Web Service. Concatenate.asmx and Concatenate.asmx.cs. @ WebService Directive. System.Web.Services Namespace. WebServiceAttribute. WebService Class. WebMethod Attribute. Session Management. Protocols. Accessing a Web Service. Generating a Proxy. Creating a Proxy Using Wsdl.exe. Creating a Windows Form Client. Asynchronous Programming in Web Services. Two Asynchronous Methods (Begin and End). Creating an ASP.NET Calculator Web Service. Web Services Are Still Evolving. Summary.



Index.

類似商品