.NET Security and Cryptography
Published on 4. September 2003
Book
Paperback/Softback
496 pages
978-0-13-100851-9 (ISBN)
Description
Part of the Integrated .NET Series, this book provides a practical and comprehensive treatment on implementing both cryptography and security features on the .NET platform - using the C# and VB .NET programming languages. It provides focused and detailed code examples that demonstrate the most important concepts, with commentary on how the code examples work. The book also provides a substantial mathematical and theoretical background on the underlying cryptographic concepts. After reading this book and experimenting with the provided example programs, the reader should have a good understanding of the major cryptographic algorithms and standard cryptographic programming techniques. Readers should also gain a solid understanding of how .NET security works and how to implement user-based and code access security in their own .NET programs.
More details
Language
English
Place of publication
Upper Saddle River
United States
Publishing group
Pearson Education (US)
Target group
College/higher education
Dimensions
Height: 235 mm
Width: 178 mm
ISBN-13
978-0-13-100851-9 (9780131008519)
Copyright in bibliographic data and cover images is held by Nielsen Book Services Limited or by the publishers or by their respective licensors: all rights reserved.
Schweitzer Classification
Persons
Peter Thorsteinson is a systems analyst who has been programming, teaching, and developing instructional materials for software development for more than ten years. He is interested in all aspects of C++, Java, and C#, as well as ATL, COM+, .NET, and J2EE. Peter has a bachelor's degree in electrical engineering from the University of Manitoba, and is coauthor of .NET Architecture and Programming Using Visual C++ and Application Development Using Visual Basic .NET, both published by Prentice Hall PTR.
G. Gnana Arun Ganesh is a developer, author and .NET consultant. He leads the .NET Technology Group at Web Prodigies, and is the host of the .NET Reference Guide area on InformIT. Arun is one of the authors of the course material for Object Innovations, which offers training in fundamental software technologies. He has published more than 50 articles about .NET technology on various .NET-related Web sites.
G. Gnana Arun Ganesh is a developer, author and .NET consultant. He leads the .NET Technology Group at Web Prodigies, and is the host of the .NET Reference Guide area on InformIT. Arun is one of the authors of the course material for Object Innovations, which offers training in fundamental software technologies. He has published more than 50 articles about .NET technology on various .NET-related Web sites.
Content
Preface.
Acknowledgments.
About This Series.
1. NET Cryptography and Security.
The Nature of This Book. Risks Are Everywhere. The Nature of Cryptography and Security. Why Cryptography and Security Are Important. What Cryptography and Security Can and Cannot Do. Windows Security Comes of Age. The .NET Framework and the CLR. How the .NET Framework Simplifies Security. Reliability and the .NET Platform. Managed Code and Type Safety. .NET Cryptography Programming. .NET Security Programming. Role-Based Security and Principals. CAS, Evidence, Policy, and Permissions. Summary.
2. Fundamentals of Cryptography.
Security and Keeping Secrets. Basic Cryptographic Terminology. Secret Keys Versus Secret Algorithms. Classical Techniques for Keeping Secrets. Brute-Force Attack Work Factor. Arbitrary Precision Arithmetic. Steganography. Modern Ciphers. Cryptography and the .NET Framework. Symmetric Cryptography. Asymmetric Cryptography. Cryptographic Algorithms. Cryptographic Protocols. Cryptanalytic Attacks. Issues in Human Interaction and Trust. Risk and Benefit. Other Important Concepts. Summary.
3. Symmetric Cryptography.
Symmetric Ciphers. DES. Modes of Operation. Triple DES. Rijndael. RC2. Programming with .NET Symmetric Cryptography. The Main Cryptography Classes. The SymmetricAlgorithm Class. SymmetricAlgorithm-Derived Classes. The SymmetricAlgorithms Example. Cryptographic Streams. Avoiding Weak Keys. Key Exchange Issues. Encrypted Hash Codes and Message Integrity. Keyed Hash Functions and Message Integrity. Summary.
4. Asymmetric Cryptography.
Problems with Symmetric Algorithms. The Key Exchange Problem. The Trust Problem. The Idea Behind Asymmetric Cryptography. Using Asymmetric Cryptography. The Combination Lock Analogy. Trapdoor One-Way Functions. Advantages of the Asymmetric Approach. Combining Asymmetric and Symmetric Algorithms. Existing Asymmetric Algorithms. RSA: The Most Used Asymmetric Algorithm. Underpinnings of RSA. A Miniature RSA Example. Caveat: Provability Issues. Programming with .NET Asymmetric Cryptography. An RSA Algorithm Example. Saving Keys as XML. Digital Certificates. Summary.
5. Digital Signatures.
Hash Algorithms. Good Hash Function Characteristics. Hash Algorithms Provided by .NET. The HashAlgorithm Class. The MD5 and SHA Classes. The KeyedHashAlgorithm Class. Object Identifiers. How Digital Signatures Work. RSA Used as a Digital Signature Algorithm. An RSA Signature Example Program. The Digital Signature Algorithm. Some Mathematical Background: Group Theory. The Discrete Logarithm Problem. How DSA Works. The Asymmetric AlgorithmHierarchy Class Hierarchy. The DSACryptoServiceProvider Class. A DSA Programming Example. Summary.
6. XML Cryptography.
XML Encryption. XML Encryption Versus SSL/TLS. The XML Encryption Specification. What XML Encryption Provides. XML Encryption Syntax. How XML Encryption Works. Classes Used in XML Encryption. Communicating Asymmetric Key Information. The XmlEncryption Example. XML Signatures. The XML Signature Specification. What XML Signatures Provide. XML Signature Syntax. Classes Used in XML Signatures. The EnvelopingXmlSignature Example. Combining XML Signing and XML Encryption. Summary.
7. NET User-Based Security.
Authentication and Authorization. .NET Security Model. Administrating Windows Security. Defining Users and Roles on Windows. Defining Shared Folder Permissions on Windows. Defining NTFS Security on Windows. Administrating .NET Security. Permissions. The IPermission Interface. The IPermission Inheritance Hierarchy. The PrincipalPermission Class. User-Based Security. Principal and Identity Objects. The IIdentity Interface. IIdentity Implementation Classes. The GenericIdentity Class. The WindowsIdentity Class. Principal Objects. The IPrincipal Interface. The GenericPrincipal Class. The WindowsPrincipal Class. Two Approaches to User-Based Security. Imperative User-Based Security. Declarative User-Based Security. Credentials. Network Credentials. Security Discipline. Principle of Least Privilege. Establish Security Policy Early. Summary.
8. NET Code Access Security.
The Need for Code Access Security. Cost Versus Risk. The Range of Risks. Assembly Trustworthiness. Risks of Calling into Unmanaged Code. Security, Managed Code, and the CLR. Microsoft Intermediate Language. Verifiably Type-Safe Code. Denying and Demanding Permissions. How CAS Is Used. Flexible Security. The Luring Attack and Walking the Stack. Managing Security Policy with Code Groups. The Basic Concepts of Security Policy Management. Using the .NET Framework Configuration Tool. Using the Caspol.exe Utility. Imperative Versus Declarative CAS. Evidence-Based Security. The Evidence Class. Obtaining the Current Application Domain Evidence. Enumerating Evidence. The WalkingThruEvidence Example. Accessing the WalkingThruEvidence Example Via IIS. Imperative CAS. Code Access Permissions. CodeAccessPermission Derived Classes. The CodeAccessPermission Class. The UrlIdentityPermission Class. Working with Code Access Permissions. Declarative Code Access Permissions. Square Bracket Attribute Declaration Syntax. The URL Identity Permission Attribute. The SecurityAction Class. Permission Requests. The PermissionRequest Example. Permission Sets. The PermissionSet Class. Defining a Permission Set in a Configuration File. Summary.
9. ASP.NET Security.
Fundamental Security Mechanisms. Authentication: Who Are You? Authorization: Are You Allowed to Access This Resource? Impersonation: Application Assumes Client's Identity. Implementing ASP.NET Authentication. ASP.NET Configuration. Facts and Benefits of the ASP.NET Configuration System. Configuration Hierarchy. Description. Forms Authentication. Method 1: Storing Credentials in the Web.config File. Method 2: Storing Credentials in the XML File. The Users.xml File. The login.aspx File. Method 3: Storing Credentials in a Database. Forms Authentication Classes. Passport Authentication. Windows Authentication. Implementing ASP.NET Authorization. File Authorization. URL Authorization. Implementing ASP.NET Impersonation. Summary.
10. Web Services Security.
Basic Techniques in Securing Web Services. Secure Connection. Authentication and Authorization. Authentication Mechanisms for HTTP. Authenticate Web Service Using SOAPHEADER. The SOAP Message Architecture. Creating a Proxy with Visual Studio .NET. XML Security Technologies. Integrity. XML Signature. Data Protection and Privacy. XML Encryption. XML Key Management Specification (XKMS). Security Assertion Markup Lanquage (SAML). Global XML Web Services Architecture (GXA). WS-Security. WS Initial Specifications. Next Steps of Specifications. Why WS-Security? Security Token Propagation. Message Integrity. Message Confidentiality. Organizations Involved. Summary.
A. A Security Attack Example: The Stack Overrun.
B. How the RSA Cipher Works.
Modular Arithmetic. The BigRSA Example Program. The CrackRSAWorkFactorDemo Example Program.
C. Using the GNU GMP Library.
Installing Cygwin. Testing Your Cygwin Installation. Installing GMP. Uninstalling Cygwin.
D. Cryptography and Security Resources.
Background Knowledge and Conceptual Books. Cryptographic Mathematics Books. Implementing Security Guide Books. Human Interest Books on Cryptography. Cryptography News Groups. Useful Cryptographic and Security Web Sites.
E. Exploring Web Services.
Motivation for Web Services. Web Services Definition. Backbones of Web Services. Next Generation of Distributed Computing: Web Services. Benefits of Web Services. ASP.NET Web Services. Web Services Architecture. Code Model for Web Services. Developing a Simple Concatenate Web Service. Concatenate.asmx and Concatenate.asmx.cs. @ WebService Directive. System.Web.Services Namespace. WebServiceAttribute. WebService Class. WebMethod Attribute. Session Management. Protocols. Accessing a Web Service. Generating a Proxy. Creating a Proxy Using Wsdl.exe. Creating a Windows Form Client. Asynchronous Programming in Web Services. Two Asynchronous Methods (Begin and End). Creating an ASP.NET Calculator Web Service. Web Services Are Still Evolving. Summary.
Index.
Acknowledgments.
About This Series.
1. NET Cryptography and Security.
The Nature of This Book. Risks Are Everywhere. The Nature of Cryptography and Security. Why Cryptography and Security Are Important. What Cryptography and Security Can and Cannot Do. Windows Security Comes of Age. The .NET Framework and the CLR. How the .NET Framework Simplifies Security. Reliability and the .NET Platform. Managed Code and Type Safety. .NET Cryptography Programming. .NET Security Programming. Role-Based Security and Principals. CAS, Evidence, Policy, and Permissions. Summary.
2. Fundamentals of Cryptography.
Security and Keeping Secrets. Basic Cryptographic Terminology. Secret Keys Versus Secret Algorithms. Classical Techniques for Keeping Secrets. Brute-Force Attack Work Factor. Arbitrary Precision Arithmetic. Steganography. Modern Ciphers. Cryptography and the .NET Framework. Symmetric Cryptography. Asymmetric Cryptography. Cryptographic Algorithms. Cryptographic Protocols. Cryptanalytic Attacks. Issues in Human Interaction and Trust. Risk and Benefit. Other Important Concepts. Summary.
3. Symmetric Cryptography.
Symmetric Ciphers. DES. Modes of Operation. Triple DES. Rijndael. RC2. Programming with .NET Symmetric Cryptography. The Main Cryptography Classes. The SymmetricAlgorithm Class. SymmetricAlgorithm-Derived Classes. The SymmetricAlgorithms Example. Cryptographic Streams. Avoiding Weak Keys. Key Exchange Issues. Encrypted Hash Codes and Message Integrity. Keyed Hash Functions and Message Integrity. Summary.
4. Asymmetric Cryptography.
Problems with Symmetric Algorithms. The Key Exchange Problem. The Trust Problem. The Idea Behind Asymmetric Cryptography. Using Asymmetric Cryptography. The Combination Lock Analogy. Trapdoor One-Way Functions. Advantages of the Asymmetric Approach. Combining Asymmetric and Symmetric Algorithms. Existing Asymmetric Algorithms. RSA: The Most Used Asymmetric Algorithm. Underpinnings of RSA. A Miniature RSA Example. Caveat: Provability Issues. Programming with .NET Asymmetric Cryptography. An RSA Algorithm Example. Saving Keys as XML. Digital Certificates. Summary.
5. Digital Signatures.
Hash Algorithms. Good Hash Function Characteristics. Hash Algorithms Provided by .NET. The HashAlgorithm Class. The MD5 and SHA Classes. The KeyedHashAlgorithm Class. Object Identifiers. How Digital Signatures Work. RSA Used as a Digital Signature Algorithm. An RSA Signature Example Program. The Digital Signature Algorithm. Some Mathematical Background: Group Theory. The Discrete Logarithm Problem. How DSA Works. The Asymmetric AlgorithmHierarchy Class Hierarchy. The DSACryptoServiceProvider Class. A DSA Programming Example. Summary.
6. XML Cryptography.
XML Encryption. XML Encryption Versus SSL/TLS. The XML Encryption Specification. What XML Encryption Provides. XML Encryption Syntax. How XML Encryption Works. Classes Used in XML Encryption. Communicating Asymmetric Key Information. The XmlEncryption Example. XML Signatures. The XML Signature Specification. What XML Signatures Provide. XML Signature Syntax. Classes Used in XML Signatures. The EnvelopingXmlSignature Example. Combining XML Signing and XML Encryption. Summary.
7. NET User-Based Security.
Authentication and Authorization. .NET Security Model. Administrating Windows Security. Defining Users and Roles on Windows. Defining Shared Folder Permissions on Windows. Defining NTFS Security on Windows. Administrating .NET Security. Permissions. The IPermission Interface. The IPermission Inheritance Hierarchy. The PrincipalPermission Class. User-Based Security. Principal and Identity Objects. The IIdentity Interface. IIdentity Implementation Classes. The GenericIdentity Class. The WindowsIdentity Class. Principal Objects. The IPrincipal Interface. The GenericPrincipal Class. The WindowsPrincipal Class. Two Approaches to User-Based Security. Imperative User-Based Security. Declarative User-Based Security. Credentials. Network Credentials. Security Discipline. Principle of Least Privilege. Establish Security Policy Early. Summary.
8. NET Code Access Security.
The Need for Code Access Security. Cost Versus Risk. The Range of Risks. Assembly Trustworthiness. Risks of Calling into Unmanaged Code. Security, Managed Code, and the CLR. Microsoft Intermediate Language. Verifiably Type-Safe Code. Denying and Demanding Permissions. How CAS Is Used. Flexible Security. The Luring Attack and Walking the Stack. Managing Security Policy with Code Groups. The Basic Concepts of Security Policy Management. Using the .NET Framework Configuration Tool. Using the Caspol.exe Utility. Imperative Versus Declarative CAS. Evidence-Based Security. The Evidence Class. Obtaining the Current Application Domain Evidence. Enumerating Evidence. The WalkingThruEvidence Example. Accessing the WalkingThruEvidence Example Via IIS. Imperative CAS. Code Access Permissions. CodeAccessPermission Derived Classes. The CodeAccessPermission Class. The UrlIdentityPermission Class. Working with Code Access Permissions. Declarative Code Access Permissions. Square Bracket Attribute Declaration Syntax. The URL Identity Permission Attribute. The SecurityAction Class. Permission Requests. The PermissionRequest Example. Permission Sets. The PermissionSet Class. Defining a Permission Set in a Configuration File. Summary.
9. ASP.NET Security.
Fundamental Security Mechanisms. Authentication: Who Are You? Authorization: Are You Allowed to Access This Resource? Impersonation: Application Assumes Client's Identity. Implementing ASP.NET Authentication. ASP.NET Configuration. Facts and Benefits of the ASP.NET Configuration System. Configuration Hierarchy. Description. Forms Authentication. Method 1: Storing Credentials in the Web.config File. Method 2: Storing Credentials in the XML File. The Users.xml File. The login.aspx File. Method 3: Storing Credentials in a Database. Forms Authentication Classes. Passport Authentication. Windows Authentication. Implementing ASP.NET Authorization. File Authorization. URL Authorization. Implementing ASP.NET Impersonation. Summary.
10. Web Services Security.
Basic Techniques in Securing Web Services. Secure Connection. Authentication and Authorization. Authentication Mechanisms for HTTP. Authenticate Web Service Using SOAPHEADER. The SOAP Message Architecture. Creating a Proxy with Visual Studio .NET. XML Security Technologies. Integrity. XML Signature. Data Protection and Privacy. XML Encryption. XML Key Management Specification (XKMS). Security Assertion Markup Lanquage (SAML). Global XML Web Services Architecture (GXA). WS-Security. WS Initial Specifications. Next Steps of Specifications. Why WS-Security? Security Token Propagation. Message Integrity. Message Confidentiality. Organizations Involved. Summary.
A. A Security Attack Example: The Stack Overrun.
B. How the RSA Cipher Works.
Modular Arithmetic. The BigRSA Example Program. The CrackRSAWorkFactorDemo Example Program.
C. Using the GNU GMP Library.
Installing Cygwin. Testing Your Cygwin Installation. Installing GMP. Uninstalling Cygwin.
D. Cryptography and Security Resources.
Background Knowledge and Conceptual Books. Cryptographic Mathematics Books. Implementing Security Guide Books. Human Interest Books on Cryptography. Cryptography News Groups. Useful Cryptographic and Security Web Sites.
E. Exploring Web Services.
Motivation for Web Services. Web Services Definition. Backbones of Web Services. Next Generation of Distributed Computing: Web Services. Benefits of Web Services. ASP.NET Web Services. Web Services Architecture. Code Model for Web Services. Developing a Simple Concatenate Web Service. Concatenate.asmx and Concatenate.asmx.cs. @ WebService Directive. System.Web.Services Namespace. WebServiceAttribute. WebService Class. WebMethod Attribute. Session Management. Protocols. Accessing a Web Service. Generating a Proxy. Creating a Proxy Using Wsdl.exe. Creating a Windows Form Client. Asynchronous Programming in Web Services. Two Asynchronous Methods (Begin and End). Creating an ASP.NET Calculator Web Service. Web Services Are Still Evolving. Summary.
Index.