Practical cryptography
by Niels Ferguson · first published 2003
49% recommend43% neutral9% critical
Why HN recommends it
Focuses on using cryptography correctly in real systems rather than algorithm catalogs, covering protocol design and common implementation mistakes without heavy math. Suits software engineers.
Common criticism: Some find it dated, with little on ECC and advice like MAC-then-Encrypt
Summarised by Claude from recommending comments
Affiliate links. As an Amazon Associate I earn from qualifying purchases.
Mentions per year
What Hacker News says
Related books
2010–2026Cryptography engineering
Niels Ferguson, Bruce Schneier, Tadayoshi Kohno
Recommended by 50 · mentioned by 8050 recommend · 80 mention50 recommend · 8050 recommend
2008–2026Applied Cryptography
Bruce Schneier
Recommended by 76 · mentioned by 18976 recommend · 189 mention76 recommend · 18976 recommend
2011–2026Handbook of applied cryptography
Alfred J. Menezes
Recommended by 14 · mentioned by 2414 recommend · 24 mention14 recommend · 2414 recommend
2017–2026Serious Cryptography
Jean-Philippe Aumasson
Recommended by 26 · mentioned by 3526 recommend · 35 mention26 recommend · 3526 recommend
Real-World Cryptography
David Wong
Recommended by 16 · mentioned by 1716 recommend · 17 mention16 recommend · 1716 recommend
2008–2026Secrets and Lies
Bruce Schneier
Recommended by 4 · mentioned by 184 recommend · 18 mention4 recommend · 184 recommend
2013–2026Introduction to modern cryptography
Jonathan Katz, Yehuda Lindell
Recommended by 13 · mentioned by 1713 recommend · 17 mention13 recommend · 1713 recommend
2014–2026Understanding cryptography
Christof Paar
Recommended by 7 · mentioned by 137 recommend · 13 mention7 recommend · 137 recommend
Practical Cryptography by Bruce Schneier and Niels Ferguson is decent in that it gives a good lay of the land without diving too deep in to the mathematical rigor. The first half explains at a high level the concepts of encryption,…
on “If you’re not using SSH certificates you’re doing SSH wrong (2019)” ↗…here, I want to note that the "new Threat Modeling" is a bit controversial, the terms are still up in the air, and if you want to learn more about security, you'd be far better off reading Ferguson's "Practical Cryptography" and McDonald, Dowd, and Schuh's "Art of Software Security Assessment". Don't build obstacle courses. Design stuff that works.
on “Why you shoud never use your favorite password on News.YCombinator.com” ↗Throw that book away, and buy Ferguson and Schneier's "Practical Cryptography", which Schneier contributed to in penance for writing "Applied Cryptography". Portions of the proceeds of "Practical Cryptography" are donated to a fund that helps the people who wrote crypto based on…
on “Typing The Letters A-E-S Into Your Code? You’re Doing It Wrong” ↗I strongly recommend this book in advance based on the fact that Ferguson is the lead author, and it's based on _Practical Cryptography_, which itself almost (but not completely) atones for _Applied Cryptography_.
on “Schneier has a new book coming out - Cryptography Engineering” ↗…an informal requirement (a software developer needs to know what the client wishes the software to do). This leads to sharing my favourite definitions of requirements and specifications; they are from Practical Cryptography by Niels Ferguson and Bruce Schneier. Chapter 9, Pages 131-132. "Requirements Requirements are an informal description of what the program is supposed to achieve. It is really a "what can I do with…
on “Favourite Definition of Requirments and Specifications” ↗How about Practical Cryptography (http://www.amazon.com/Practical-Cryptography-Niels-Ferguson/...) as a quick-guide over the more verbose Applied Cryptography which is much older than the former?
on “Practical Cryptography With Go” ↗…reading the rest of this subthread, I believe I understand it now. He's probably just misguided or simply incorrect. And I admit that most of my crypto knowledge comes from reading his and Ferguson's book, Practical Cryptography (and the 2nd edition, Cryptography Engineering - I'm not sure there is a better "popsci" crypto book.) To make a simple comparison: if someone smarter than me says 2+2=5, my probability of 2+2=4 will…
on “Encrypting Windows Hard Drives” ↗Ferguson and Schneier wrote a followup book, "Practical Cryptography", which addresses the shortcomings of "Applied Cryptography" --- it selects the "best" algorithms and protocols to use, and tries to document the pitfalls of actually implementing them in real software.…
on “This New Vulnerability: Dowd’s Inhuman Flash Exploit” ↗Practical Cryptography, Ferguson and Schneier. Written partly as penance for Applied Cryptography.
on “Twitter's OAuth has a gaping security hole” ↗"Practical Cryptography", by Bruce Schneier and Niels Ferguson, is meant to atone for the unfortunate real-world consequences of Applied Cryptography. It is comprehensive and good for people with basic discrete mathematics understanding.
on “Bletchley – A Collection of Practical Cryptanalysis Tools” ↗They're two completely different things. AES is an encryption algorithm. bcrypt is a special-purpose hash algorithm. If you're confused, I'd highly recommend Practical Cryptography by Niels Furguson and Bruce Schneier: http://www.schneier.com/book-practical.html It will give you much better advice than the internet will.
Applied Cryptography, no matter what Matthew Green may have to say about it, is a terrible book to learn cryptography from. I highly recommend you burn it and instead pick up a copy of Practical Cryptography (or Cryptography Engineering, which is the exact same book). The mark of a good book on a security topic is, you can read it "upside down" and learn how to break things instead of build them.
on “New Stanford class on Cryptography” ↗Applied Cryptography is a terrible reference. Please don't recommend it to programmers. Instead, recommend Practical Cryptography / Cryptography Engineering (they're the same book), which Schneier co-authored with Niels Fergusen. Update: I said "terrible book" but I'm going to start being more precise about this. It's not a terrible…
on “The Boston Marathon Bombing: Keep Calm and Carry On” ↗I would recommend Schneier's Cryptography Engineering (or its predecessor) Practical Cryptography over Applied Cryptography, given the question. I agree Applied Cryptography is a very interesting book, but that's because I'm a crypto nerd. For someone looking to improve general software engineering…
on “Ask HN: What language-agnostic programming books should I read?” ↗Not OP but check out this book [1]. Apress currently has back to school discount until the end of this week. [1]Practical Cryptography in Python: Learning Correct Cryptography by Example: https://link.springer.com/book/10.1007/978-1-4842-4900-0
on “Free 6h course on fundamental cryptography with Python” ↗