Always Learning

.NET Security and Cryptography
Peter Thorsteinson
G. Gnana Arun Ganesh

ISBN-10: 013100851X
ISBN-13:  9780131008519

Publisher:  Prentice Hall
Copyright:  2004
Format:  Paper; 496 pp
Published:  08/18/2003
Status: Instock


Customers outside the U.S., click here.


Print this content

In this section:


Table of Contents



Preface.


Acknowledgments.


About This Series.


1. NET Cryptography and Security.

The Nature of This Book. Risks Are Everywhere. The Nature of Cryptography and Security. Why Cryptography and Security Are Important. What Cryptography and Security Can and Cannot Do. Windows Security Comes of Age. The .NET Framework and the CLR. How the .NET Framework Simplifies Security. Reliability and the .NET Platform. Managed Code and Type Safety. .NET Cryptography Programming. .NET Security Programming. Role-Based Security and Principals. CAS, Evidence, Policy, and Permissions. Summary.



2. Fundamentals of Cryptography.

Security and Keeping Secrets. Basic Cryptographic Terminology. Secret Keys Versus Secret Algorithms. Classical Techniques for Keeping Secrets. Brute-Force Attack Work Factor. Arbitrary Precision Arithmetic. Steganography. Modern Ciphers. Cryptography and the .NET Framework. Symmetric Cryptography. Asymmetric Cryptography. Cryptographic Algorithms. Cryptographic Protocols. Cryptanalytic Attacks. Issues in Human Interaction and Trust. Risk and Benefit. Other Important Concepts. Summary.



3. Symmetric Cryptography.

Symmetric Ciphers. DES. Modes of Operation. Triple DES. Rijndael. RC2. Programming with .NET Symmetric Cryptography. The Main Cryptography Classes. The SymmetricAlgorithm Class. SymmetricAlgorithm-Derived Classes. The SymmetricAlgorithms Example. Cryptographic Streams. Avoiding Weak Keys. Key Exchange Issues. Encrypted Hash Codes and Message Integrity. Keyed Hash Functions and Message Integrity. Summary.



4. Asymmetric Cryptography.

Problems with Symmetric Algorithms. The Key Exchange Problem. The Trust Problem. The Idea Behind Asymmetric Cryptography. Using Asymmetric Cryptography. The Combination Lock Analogy. Trapdoor One-Way Functions. Advantages of the Asymmetric Approach. Combining Asymmetric and Symmetric Algorithms. Existing Asymmetric Algorithms. RSA: The Most Used Asymmetric Algorithm. Underpinnings of RSA. A Miniature RSA Example. Caveat: Provability Issues. Programming with .NET Asymmetric Cryptography. An RSA Algorithm Example. Saving Keys as XML. Digital Certificates. Summary.



5. Digital Signatures.

Hash Algorithms. Good Hash Function Characteristics. Hash Algorithms Provided by .NET. The HashAlgorithm Class. The MD5 and SHA Classes. The KeyedHashAlgorithm Class. Object Identifiers. How Digital Signatures Work. RSA Used as a Digital Signature Algorithm. An RSA Signature Example Program. The Digital Signature Algorithm. Some Mathematical Background: Group Theory. The Discrete Logarithm Problem. How DSA Works. The Asymmetric AlgorithmHierarchy Class Hierarchy. The DSACryptoServiceProvider Class. A DSA Programming Example. Summary.



6. XML Cryptography.

XML Encryption. XML Encryption Versus SSL/TLS. The XML Encryption Specification. What XML Encryption Provides. XML Encryption Syntax. How XML Encryption Works. Classes Used in XML Encryption. Communicating Asymmetric Key Information. The XmlEncryption Example. XML Signatures. The XML Signature Specification. What XML Signatures Provide. XML Signature Syntax. Classes Used in XML Signatures. The EnvelopingXmlSignature Example. Combining XML Signing and XML Encryption. Summary.



7. NET User-Based Security.

Authentication and Authorization. .NET Security Model. Administrating Windows Security. Defining Users and Roles on Windows. Defining Shared Folder Permissions on Windows. Defining NTFS Security on Windows. Administrating .NET Security. Permissions. The IPermission Interface. The IPermission Inheritance Hierarchy. The PrincipalPermission Class. User-Based Security. Principal and Identity Objects. The IIdentity Interface. IIdentity Implementation Classes. The GenericIdentity Class. The WindowsIdentity Class. Principal Objects. The IPrincipal Interface. The GenericPrincipal Class. The WindowsPrincipal Class. Two Approaches to User-Based Security. Imperative User-Based Security. Declarative User-Based Security. Credentials. Network Credentials. Security Discipline. Principle of Least Privilege. Establish Security Policy Early. Summary.



8. NET Code Access Security.

The Need for Code Access Security. Cost Versus Risk. The Range of Risks. Assembly Trustworthiness. Risks of Calling into Unmanaged Code. Security, Managed Code, and the CLR. Microsoft Intermediate Language. Verifiably Type-Safe Code. Denying and Demanding Permissions. How CAS Is Used. Flexible Security. The Luring Attack and Walking the Stack. Managing Security Policy with Code Groups. The Basic Concepts of Security Policy Management. Using the .NET Framework Configuration Tool. Using the Caspol.exe Utility. Imperative Versus Declarative CAS. Evidence-Based Security. The Evidence Class. Obtaining the Current Application Domain Evidence. Enumerating Evidence. The WalkingThruEvidence Example. Accessing the WalkingThruEvidence Example Via IIS. Imperative CAS. Code Access Permissions. CodeAccessPermission Derived Classes. The CodeAccessPermission Class. The UrlIdentityPermission Class. Working with Code Access Permissions. Declarative Code Access Permissions. Square Bracket Attribute Declaration Syntax. The URL Identity Permission Attribute. The SecurityAction Class. Permission Requests. The PermissionRequest Example. Permission Sets. The PermissionSet Class. Defining a Permission Set in a Configuration File. Summary.



9. ASP.NET Security.

Fundamental Security Mechanisms. Authentication: Who Are You? Authorization: Are You Allowed to Access This Resource? Impersonation: Application Assumes Client's Identity. Implementing ASP.NET Authentication. ASP.NET Configuration. Facts and Benefits of the ASP.NET Configuration System. Configuration Hierarchy. Description. Forms Authentication. Method 1: Storing Credentials in the Web.config File. Method 2: Storing Credentials in the XML File. The Users.xml File. The login.aspx File. Method 3: Storing Credentials in a Database. Forms Authentication Classes. Passport Authentication. Windows Authentication. Implementing ASP.NET Authorization. File Authorization. URL Authorization. Implementing ASP.NET Impersonation. Summary.



10. Web Services Security.

Basic Techniques in Securing Web Services. Secure Connection. Authentication and Authorization. Authentication Mechanisms for HTTP. Authenticate Web Service Using SOAPHEADER. The SOAP Message Architecture. Creating a Proxy with Visual Studio .NET. XML Security Technologies. Integrity. XML Signature. Data Protection and Privacy. XML Encryption. XML Key Management Specification (XKMS). Security Assertion Markup Lanquage (SAML). Global XML Web Services Architecture (GXA). WS-Security. WS Initial Specifications. Next Steps of Specifications. Why WS-Security? Security Token Propagation. Message Integrity. Message Confidentiality. Organizations Involved. Summary.



A. A Security Attack Example: The Stack Overrun.


B. How the RSA Cipher Works.

Modular Arithmetic. The BigRSA Example Program. The CrackRSAWorkFactorDemo Example Program.



C. Using the GNU GMP Library.

Installing Cygwin. Testing Your Cygwin Installation. Installing GMP. Uninstalling Cygwin.



D. Cryptography and Security Resources.

Background Knowledge and Conceptual Books. Cryptographic Mathematics Books. Implementing Security Guide Books. Human Interest Books on Cryptography. Cryptography News Groups. Useful Cryptographic and Security Web Sites.



E. Exploring Web Services.

Motivation for Web Services. Web Services Definition. Backbones of Web Services. Next Generation of Distributed Computing: Web Services. Benefits of Web Services. ASP.NET Web Services. Web Services Architecture. Code Model for Web Services. Developing a Simple Concatenate Web Service. Concatenate.asmx and Concatenate.asmx.cs. @ WebService Directive. System.Web.Services Namespace. WebServiceAttribute. WebService Class. WebMethod Attribute. Session Management. Protocols. Accessing a Web Service. Generating a Proxy. Creating a Proxy Using Wsdl.exe. Creating a Windows Form Client. Asynchronous Programming in Web Services. Two Asynchronous Methods (Begin and End). Creating an ASP.NET Calculator Web Service. Web Services Are Still Evolving. Summary.



Index.



Back to top

Print this content

In this section:


Sample Chapter

View a Sample Chapter PDF:/samplechapter/013100851X.pdf


Author Bios

Peter Thorsteinson is a systems analyst who has been programming, teaching, and developing instructional materials for software development for more than ten years. He is interested in all aspects of C++, Java, and C#, as well as ATL, COM+, .NET, and J2EE. Peter has a bachelor's degree in electrical engineering from the University of Manitoba, and is coauthor of .NET Architecture and Programming Using Visual C++ and Application Development Using Visual Basic .NET, both published by Prentice Hall PTR.

G. Gnana Arun Ganesh is a developer, author and .NET consultant. He leads the .NET Technology Group at Web Prodigies, and is the host of the .NET Reference Guide area on InformIT. Arun is one of the authors of the course material for Object Innovations, which offers training in fundamental software technologies. He has published more than 50 articles about .NET technology on various .NET-related Web sites.


Backcover Copy

Learn how to make your .NET applications secure!

Security and cryptography, while always an essential part of the computing industry, have seen their importance increase greatly in the last several years. Microsoft's .NET Framework provides developers with a powerful new set of tools to make their applications secure. NET Security and Cryptography is a practical and comprehensive guide to implementing both the security and the cryptography features found in the .NET platform. The authors provide numerous clear and focused examples in both C# and Visual Basic .NET, as well as detailed commentary on how the code works. They cover topics in a logical sequence and context, where they are most relevant and most easily understood. All of the sample code is available online at <www.objectinnovations.com/library/books/books_dotnet.html>.

This book will allow developers to:

  • Develop a solid basis in the theory of cryptography, so they can understand how the security tools in the .NET Framework function
  • Learn to use symmetric algorithms, asymmetric algorithms, and digital signatures
  • Master both traditional encryption programming as well as the new techniques of XML encryption and XML signatures
  • Learn how these tools apply to ASP.NET and Web Services security

Back to top

Print this content

This product is a member of the following series. Click on the series name to see the full list of products in the series.

Back to top

Log in to the Instructor Resource Center

Login name: 

  Password: 

Forgot login/password?  |  Need to redeem an access code?

        

Instructor Resource Center File Download

This work is protected by local and international copyright laws and is provided solely for the use of instructors in teaching their courses and assessing student learning. Dissemination or sale of any part of this work (including on the World Wide Web) will destroy the integrity of the work and is not permitted. The work and materials from this site should never be made available to students except by instructors using the accompanying text in their classes. All recipients of this work are expected to abide by these restrictions and to honor the intended pedagogical purposes and the needs of other instructors who rely on these materials.

Cancel     I accept, proceed with download

Print this content

Pearson Higher Education offers special pricing when you choose to package your text with other student resources. If you're interested in creating a cost-saving package for your students, browse our available packages below, or contact your Pearson Higher Education representative to create your own package.

Package ISBN-10: 0135104750 | ISBN-13: 9780135104750
©2004 | Instock (Additional assembly time required)
Suggested retail price: $67.67  Buy from myPearsonStore

This package contains:

Thorsteinson & Ganesh | ©2004 | Prentice Hall | Paper; 496 pp
Gong, Ellison & Dageforde | ©2003 | Prentice Hall | Paper; 384 pp


Back to top