Название: SSL and TLS: Theory and Practice, 3rd Edition
Автор: Rolf Oppliger
Издательство: Artech House
Год: 2023
Страниц: 383
Язык: английский
Формат: pdf (true)
Размер: 10.2 MB

Now in its Third Edition, this completely revised and updated reference provides a thorough and comprehensive introduction into the SSL, TLS, and DTLS protocols, explaining all the details and technical subtleties and showing how the current design helps mitigate the attacks that have made press headlines in the past. The book tells the complete story of TLS, from its earliest incarnation (SSL 1.0 in 1994), all the way up to and including TLS 1.3. Detailed descriptions of each protocol version give you a full understanding of why the protocol looked like it did, and why it now looks like it does.

You will get a clear, detailed introduction to TLS 1.3 and understand the broader context of how TLS works with firewall and network middleboxes, as well the key topic of public infrastructures and their role in securing TLS. You will also find similar details on DTLS, a close sibling of TLS that is designed to operate over UDP instead of TCP. The book helps you fully understand the rationale behind the design of the SSL, TLS, and DTLS protocols and all of its extensions. It also gives you an in-depth and accessible breakdown of the many vulnerabilities in earlier versions of TLS, thereby more fully equipping you to properly configure and use the protocols in the field and protect against specific (network-based) attacks.

TLS was always of interest to security researchers. But due to its growing importance, TLS was subjected to more intense scrutiny by the research community over the last decade or so. This activity uncovered significant weaknesses in earlier versions of the protocol, in its implementations, and in the supporting public key infrastructure. Notably, numerous vulnerabilities were found both in the TLS record protocol (which uses symmetric cryptographic algorithms to provide confidentiality and integrity for application data) and in the TLS handshake protocol (which perform entity authentication of protocol participants and establishes secure key material for use in the record protocol). Indeed, in the period 2011–2016, it felt like barely a month went by without some new vulnerability related to TLS being announced via a backronym, a logo, and a website. The practical impact of these vulnerabilities was and remains debatable. However, they collectively indicated a protocol that was starting to show signs of age and in need of a revamp.

With its thorough discussion of widely deployed network security technology, coupled with its practical applications you can utilize today, this is a must-have book for network security practitioners and software/web application developers at all levels.