Table of Contents
Preface.
Acknowledgments.
About This Series.
1. NET Cryptography and Security.
The Nature of This Book. Risks Are Everywhere. The Nature of Cryptography and Security. Why Cryptography and Security Are Important. What Cryptography and Security Can and Cannot Do. Windows Security Comes of Age. The .NET Framework and the CLR. How the .NET Framework Simplifies Security. Reliability and the .NET Platform. Managed Code and Type Safety. .NET Cryptography Programming. .NET Security Programming. Role-Based Security and Principals. CAS, Evidence, Policy, and Permissions. Summary.
2. Fundamentals of Cryptography. Security and Keeping Secrets. Basic Cryptographic Terminology. Secret Keys Versus Secret Algorithms. Classical Techniques for Keeping Secrets. Brute-Force Attack Work Factor. Arbitrary Precision Arithmetic. Steganography. Modern Ciphers. Cryptography and the .NET Framework. Symmetric Cryptography. Asymmetric Cryptography. Cryptographic Algorithms. Cryptographic Protocols. Cryptanalytic Attacks. Issues in Human Interaction and Trust. Risk and Benefit. Other Important Concepts. Summary.
3. Symmetric Cryptography. Symmetric Ciphers. DES. Modes of Operation. Triple DES. Rijndael. RC2. Programming with .NET Symmetric Cryptography. The Main Cryptography Classes. The SymmetricAlgorithm Class. SymmetricAlgorithm-Derived Classes. The SymmetricAlgorithms Example. Cryptographic Streams. Avoiding Weak Keys. Key Exchange Issues. Encrypted Hash Codes and Message Integrity. Keyed Hash Functions and Message Integrity. Summary.
4. Asymmetric Cryptography. Problems with Symmetric Algorithms. The Key Exchange Problem. The Trust Problem. The Idea Behind Asymmetric Cryptography. Using Asymmetric Cryptography. The Combination Lock Analogy. Trapdoor One-Way Functions. Advantages of the Asymmetric Approach. Combining Asymmetric and Symmetric Algorithms. Existing Asymmetric Algorithms. RSA: The Most Used Asymmetric Algorithm. Underpinnings of RSA. A Miniature RSA Example. Caveat: Provability Issues. Programming with .NET Asymmetric Cryptography. An RSA Algorithm Example. Saving Keys as XML. Digital Certificates. Summary.
5. Digital Signatures. Hash Algorithms. Good Hash Function Characteristics. Hash Algorithms Provided by .NET. The HashAlgorithm Class. The MD5 and SHA Classes. The KeyedHashAlgorithm Class. Object Identifiers. How Digital Signatures Work. RSA Used as a Digital Signature Algorithm. An RSA Signature Example Program. The Digital Signature Algorithm. Some Mathematical Background: Group Theory. The Discrete Logarithm Problem. How DSA Works. The Asymmetric AlgorithmHierarchy Class Hierarchy. The DSACryptoServiceProvider Class. A DSA Programming Example. Summary.
6. XML Cryptography. XML Encryption. XML Encryption Versus SSL/TLS. The XML Encryption Specification. What XML Encryption Provides. XML Encryption Syntax. How XML Encryption Works. Classes Used in XML Encryption. Communicating Asymmetric Key Information. The XmlEncryption Example. XML Signatures. The XML Signature Specification. What XML Signatures Provide. XML Signature Syntax. Classes Used in XML Signatures. The EnvelopingXmlSignature Example. Combining XML Signing and XML Encryption. Summary.
7. NET User-Based Security. Authentication and Authorization. .NET Security Model. Administrating Windows Security. Defining Users and Roles on Windows. Defining Shared Folder Permissions on Windows. Defining NTFS Security on Windows. Administrating .NET Security. Permissions. The IPermission Interface. The IPermission Inheritance Hierarchy. The PrincipalPermission Class. User-Based Security. Principal and Identity Objects. The IIdentity Interface. IIdentity Implementation Classes. The GenericIdentity Class. The WindowsIdentity Class. Principal Objects. The IPrincipal Interface. The GenericPrincipal Class. The WindowsPrincipal Class. Two Approaches to User-Based Security. Imperative User-Based Security. Declarative User-Based Security. Credentials. Network Credentials. Security Discipline. Principle of Least Privilege. Establish Security Policy Early. Summary.
8. NET Code Access Security. The Need for Code Access Security. Cost Versus Risk. The Range of Risks. Assembly Trustworthiness. Risks of Calling into Unmanaged Code. Security, Managed Code, and the CLR. Microsoft Intermediate Language. Verifiably Type-Safe Code. Denying and Demanding Permissions. How CAS Is Used. Flexible Security. The Luring Attack and Walking the Stack. Managing Security Policy with Code Groups. The Basic Concepts of Security Policy Management. Using the .NET Framework Configuration Tool. Using the Caspol.exe Utility. Imperative Versus Declarative CAS. Evidence-Based Security. The Evidence Class. Obtaining the Current Application Domain Evidence. Enumerating Evidence. The WalkingThruEvidence Example. Accessing the WalkingThruEvidence Example Via IIS. Imperative CAS. Code Access Permissions. CodeAccessPermission Derived Classes. The CodeAccessPermission Class. The UrlIdentityPermission Class. Working with Code Access Permissions. Declarative Code Access Permissions. Square Bracket Attribute Declaration Syntax. The URL Identity Permission Attribute. The SecurityAction Class. Permission Requests. The PermissionRequest Example. Permission Sets. The PermissionSet Class. Defining a Permission Set in a Configuration File. Summary.
9. ASP.NET Security. Fundamental Security Mechanisms. Authentication: Who Are You? Authorization: Are You Allowed to Access This Resource? Impersonation: Application Assumes Client's Identity. Implementing ASP.NET Authentication. ASP.NET Configuration. Facts and Benefits of the ASP.NET Configuration System. Configuration Hierarchy. Description. Forms Authentication. Method 1: Storing Credentials in the Web.config File. Method 2: Storing Credentials in the XML File. The Users.xml File. The login.aspx File. Method 3: Storing Credentials in a Database. Forms Authentication Classes. Passport Authentication. Windows Authentication. Implementing ASP.NET Authorization. File Authorization. URL Authorization. Implementing ASP.NET Impersonation. Summary.
10. Web Services Security. Basic Techniques in Securing Web Services. Secure Connection. Authentication and Authorization. Authentication Mechanisms for HTTP. Authenticate Web Service Using SOAPHEADER. The SOAP Message Architecture. Creating a Proxy with Visual Studio .NET. XML Security Technologies. Integrity. XML Signature. Data Protection and Privacy. XML Encryption. XML Key Management Specification (XKMS). Security Assertion Markup Lanquage (SAML). Global XML Web Services Architecture (GXA). WS-Security. WS Initial Specifications. Next Steps of Specifications. Why WS-Security? Security Token Propagation. Message Integrity. Message Confidentiality. Organizations Involved. Summary.
A. A Security Attack Example: The Stack Overrun. B. How the RSA Cipher Works. Modular Arithmetic. The BigRSA Example Program. The CrackRSAWorkFactorDemo Example Program.
C. Using the GNU GMP Library. Installing Cygwin. Testing Your Cygwin Installation. Installing GMP. Uninstalling Cygwin.
D. Cryptography and Security Resources. Background Knowledge and Conceptual Books. Cryptographic Mathematics Books. Implementing Security Guide Books. Human Interest Books on Cryptography. Cryptography News Groups. Useful Cryptographic and Security Web Sites.
E. Exploring Web Services. Motivation for Web Services. Web Services Definition. Backbones of Web Services. Next Generation of Distributed Computing: Web Services. Benefits of Web Services. ASP.NET Web Services. Web Services Architecture. Code Model for Web Services. Developing a Simple Concatenate Web Service. Concatenate.asmx and Concatenate.asmx.cs. @ WebService Directive. System.Web.Services Namespace. WebServiceAttribute. WebService Class. WebMethod Attribute. Session Management. Protocols. Accessing a Web Service. Generating a Proxy. Creating a Proxy Using Wsdl.exe. Creating a Windows Form Client. Asynchronous Programming in Web Services. Two Asynchronous Methods (Begin and End). Creating an ASP.NET Calculator Web Service. Web Services Are Still Evolving. Summary.
Index.
Forewords & Introductions
Over the last several years, security and cryptography technologies have been continually increasing in importance to Windows users and software developers. Additionally, in some respects the security and cryptographic capabilities of 32-bit Windows has reached parity with larger mini and mainframe computing platforms, where security has always been a major priority. Now, with the advent of .NET, these security capabilities have become much easier to implement than ever before. Of course, a significant investment in effort is still required in understanding the concepts and acquiring the skills necessary to leverage the many security features provided by .NET. Indeed, that is exactly what this book is all about. Although much of the same functionality was provided in the form of an arcane Win32 C Windows library, the advent of .NET has made security and cryptography programming much simpler and much more powerful than ever before. The .NET Security Framework provides a powerful set of security and cryptographic classes that are relatively easy to use, and this framework is explored throughout this book.
This book is intended to provide a practical and comprehensive coverage on implementing both cryptography and security functionality on the .NET platform. It is an effective tutorial, providing a large number of clear and focused code examples.
Organization
The book is organized into 10 chapters and five appendixes. Chapter 1 introduces cryptography and security on the .NET platform and provides a nontechnical overview of the topics that are described in greater detail in subsequent chapters. This first chapter also provides the reasoning behind the layout of thebook and how the two main topics of cryptography and security interrelate. The purpose of this chapter is not to provide significant depth or code examples, but rather to convey conceptual understanding and to provide an overview of cryptography and security technologies on the .NET platform. Chapter 2 provides a solid theoretical background to promote a deeper insight into all subsequent chapters. The point is made that all security is based on cryptography, and, to understand cryptography in a meaningful way, it is necessary to first understand several basic theoretical cryptographic concepts. Chapters 3, 4, 5, and 6 provide detailed hands-on .NET programming examples, using symmetric algorithms, asymmetric algorithms, digital signatures, and XML cryptography, respectively. Chapters 7 and 8 cover .NET programming with user-based security and code access security, respectively. Chapter 9 introduces ASP.NET security programming, and chapter 10 introduces .NET Web Services security programming.
Each aspect of .NET cryptography and security is dealt with in the proper context and sequence, where they are most relevant and most easily understood. Appendixes describe a few additional topics, such as security attacks and additional cryptography-related mathematical topics.
This book is intended to be a practical tutorial with many succinct programming examples that focus on specific and individual concepts. Also, the focus of the book is on practical .NET security programming rather than on administrative security tasks. This book provides sufficient background information to enable the reader to clearly see why security and cryptography are critically important to modern software development. The goal is to equip the reader to begin building significant applications using the .NET Security Framework. This book is part of The Integrated .NET Series from Object Innovations and Prentice Hall PTR.
Sample Programs
The best way to learn about a significant class library such as the .NET Security Framework is to read and write many programs. This book provides many small programs that illustrate each of the pertinent features of .NET in isolation, which makes them easier to understand. The programs are clearly labeled in the text, and they can all be found in the software distribution that accompanies this book. These sample programs are provided in a self-extracting file on the book's Web site. When expanded, a directory structure is created whose default root is c:\OI\NetSecurity. The sample programs, which begin with the second chapter, are in directories Chap02, Chap03, and so on. All the samples for a given chapter are in individual folders within the chapter directories. The names of the folders are clearly identified in the text.
This book is part of The Integrated .NET Series. The sample programs for other books in the series are located in their own directories underneath \OI, so all the .NET examples from all books in the series will be located in a common area as you install them. These programs are furnished solely for instructional purposes and should not be embedded in any software product. The software (including instructions for use) is provided "as is" without warranty of any kind.
Web Site
Loading...