.NET Security and Cryptography

Peter Thorsteinson is a systems analyst who has been programming, teaching, and developing instructional materials for software development for more than 10 years G. Gnana Arun Ganesh is a developer, author, and .NET consultant

Over the last several years, security and cryptography technologies have been continually increasing in importance to Windows users and software developers. Additionally, in some respects the security and cryptographic capabilities of 32-bit Windows has reached parity with larger mini and mainframe computing platforms, where security has always been a major priority. Now, with the advent of .NET, these security capabilities have become much easier to implement than ever before. Of course, a significant investment in effort is still required in understanding the concepts and acquiring the skills necessary to leverage the many security features provided by .NET. Indeed, that is exactly what this book is all about. Although much of the same functionality was provided in the form of an arcane Win32 C Windows library, the advent of .NET has made security and cryptography programming much simpler and much more powerful than ever before. The .NET Security Framework provides a powerful set of security and cryptographic classes that are relatively easy to use, and this framework is explored throughout this book.This book is intended to provide a practical and comprehensive coverage on implementing both cryptography and security functionality on the .NET platform. It is an effective tutorial, providing a large number of clear and focused code examples. OrganizationThe book is organized into 10 chapters and five appendixes. Chapter 1 introduces cryptography and security on the .NET platform and provides a nontechnical overview of the topics that are described in greater detail in subsequent chapters. This first chapter also provides the reasoning behind the layout of the book and how the two main topics of cryptography and security interrelate. The purpose of this chapter is not to provide significant depth or code examples, but rather to convey conceptual understanding and to provide an overview of cryptography and security technologies on the .NET platform. Chapter 2 provides a solid theoretical background to promote a deeper insight into all subsequent chapters. The point is made that all security is based on cryptography, and, to understand cryptography in a meaningful way, it is necessary to first understand several basic theoretical cryptographic concepts. Chapters 3, 4, 5, and 6 provide detailed hands-on .NET programming examples, using symmetric algorithms, asymmetric algorithms, digital signatures, and XML cryptography, respectively. Chapters 7 and 8 cover .NET programming with user-based security and code access security, respectively. Chapter 9 introduces ASP.NET security programming, and chapter 10 introduces .NET Web Services security programming.Each aspect of .NET cryptography and security is dealt with in the proper context and sequence, where they are most relevant and most easily understood. Appendixes describe a few additional topics, such as security attacks and additional cryptography-related mathematical topics.This book is intended to be a practical tutorial with many succinct programming examples that focus on specific and individual concepts. Also, the focus of the book is on practical .NET security programming rather than on administrative security tasks. This book provides sufficient background information to enable the reader to clearly see why security and cryptography are critically important to modern software development. The goal is to equip the reader to begin building significant applications using the .NET Security Framework. This book is part of The Integrated .NET Series from Object Innovations and Prentice Hall PTR. Sample ProgramsThe best way to learn about a significant class library such as the .NET Security Framework is to read and write many programs. This book provides many small programs that illustrate each of the pertinent features of .NET in isolation, which makes them easier to understand. The programs are clearly labeled in the