SSL and TLS: Designing and Building Secure Systems

By Eric Rescorla

Book Overview

Secure Sockets Layer (SSL) is used in virtually every commercial web browser and server. In this book, one of the world's leading network security experts explains how SSL works -- and gives implementers step-by-step guidance and proven design patterns for building secure systems with SSL. Eric Rescorla also provides the first in-depth introduction to Transport Layer Security (TLS), the highly anticipated, maximum-security successor to SSL. KEY TOPICS: Rescorla starts by introducing SSL's fundamentals: how it works, and the threats it is intended to address. One step at a time, he addresses each key SSL concept and technique, including cryptography, SSL performance optimization, designing and coding, and how to work around SSL's limitations. Rescorla demonstrates TLS at work in SMTP-based Internet security applications. The book includes detailed examples of SSL/TLS implementations, with in-depth insight into the key design choices that informed them. MARKET: For all network and security designers, enterprise developers, system implementers, and suppliers of Internet security products and services.

• Format: Paperback
• Language: English
• ISBN: 0201615983
• ISBN13: 9780201615982
• Release Date: January 2000
• Publisher: Addison-Wesley Professional
• Length: 499 Pages
• Weight: 1.78 lbs.
• Dimensions: 0.9" x 7.3" x 9.2"

Customer Reviews

Thoroughly impressed

The definitive reference on SSL and TLS. If you rely on SSL/TLS, need a way to secure communications channels of some system, or are just curious about the protocol, this is the book for you. The author has a very clear and down-to-earth writing style that makes the technical material easy to follow, and the diagrams and protocol traces help make the workings of the protocol more concrete. As a result, it is easier to follow, and gives more practical details, than the RFCs. This one is staying on my shelf.

Five stars from a designer of SSL

As one of the three co-designers of SSL v3, I highly recommend this book -- it's the best book I've seen on SSL/TLS. Eric knows the protocol inside and out and does an excellent job of explaining both the practice and theory of SSL and TLS. The book also includes includes lots of practical information that isn't in the spec about how things are actually done and does a great job explaining the underlying cryptography and security.

The book on SSL/TLS I was waiting for.

Before this book came along documentation about SSL was fragmentary. You had to learn about SSL from old Netscape draft standards documents, notes, examples, RFCs, existing code, etc. I wished for just such a book as this one. All the essential up-to-date information in one place. I bought it shortly after publication and it exceeded all my expectations. Thorough, clear introduction to the subject of SSL for programmers. The author also provides interesting background material, such as how TLS evolved from pre-existing protocols. The book is very readable and I practically read it from start to finish which is unusual for a technical book. If someone asked me to recommend a book I would suggest this one. And now I am waiting for the book on X.509.

Great book

I agree with the other reviewers that this is a great book. It's written in such a way that it's useful for readers that intend to use SSL at different levels. For example, there are places that tell you can skip ahead to the next chapter unless you are actually implementing SSL. I also really liked the initial chapter about the general security concepts involved in SSL. It was something I didn't know a lot about and it was very well explained.

Truly excellent book.

I was basically hoping for an SSL appendix to Stevens's TCP/IP Illustrated and was not at all disappointed. Rescorla makes excellent use of chronological network traces and has written an SSL equivalent to tcpdump to help illustrate what's going on. This makes for clear explainations, and a steep but none the less thoroughly attainable learning curve.One word I noticed being used a whole lot was 'why'. Rescorla goes to some lengths to explain the why's of network security, and uses simple concepts to illustrate these.It also presents a fairly precise history of the whole SSL thing from an entirely neutral political standpoint. He gives credit where it is due - even to Microsoft who, as it turns out, were trying to do the right thing all along. The neutrality also shows when Rescorla goes to lengths to point out potential conflicts of interest when the story involves him, personally.All in all, if you couldn't tell, I'm very impressed. This is a complex topic, perhaps *the* complex topic and it is handled in a controlled manner. You'll need to be reasonably au fait with TCP/IP and internet protocols in general, but from that point on you're in safe hands.