Best Practices

Abstract

For those struggling with cryptographic security policies and practices, this column may help to develop some best practices. These practices reflect the author's experience and national and international standards efforts. The author has written this article for information security managers and professionals who already have some background in cryptography. For those who would like more background material, the following books are recommended: • Vijay Ahuja's book Secure Commerce on the Internet (published by AP Professional, 1997) describes many of the uses of cryptography. • David Kahn's The Codebreakers (published by Macmillan Publishing Co., Inc., 1967) is the definitive history of cryptology. • Whitfield Diffie's and Susan Landau's Privacy on the Line (published by MIT Press, 1998) provides an excellent debate on the politics of wiretapping and encryption. This book also presents a clear case for effective cryptographic security in industry. • Alfred J. Menezes, Paul C. van Oorschot, and Scott A. Vanstone wrote the technical bible on cryptography nicknamed the “HACk,” Handbook on Applied Cryptography (published by CRC Press, 1997). This highly technical book is a serious reference book for implementers of cryptographic systems.