"The tie, if I might suggest it, sin a shade more tightly knotted. One
.'
aims at the Derfect butternv effect. If you will permit me --"
perfect butterfly effect. If you will permit me --"
"What does it matted JeeveS, at a time like this? Do you realize that
Mr Little's domestic hapDiness is handing in the scale2"
PPiness is hanging in the scaleZ"
"There is no time sin at which ties do not matter"
I r
-- Wry Good, Jeeves! P. G. WOdehouse
y "cod, Jeeves! P. G. WOdehouse
In this age of universal electronic connectivitV, of viruses and hackers, of electronic
eavesa y, of viruses and hackers, of electronic
eavesdropping and electronic fraud, there is indeed no time at which security does not matter. TWo
pping and electronic fraud, there is indeed no time at which security does not matter. TWo
trends have come together to make the topic of this book of vital interest. First, the explosive
a pie of this book of vital interest. First, the explosive
growth in computer systems and their interconnections via networks has increased the
dependence of both organizations and individuals on the information stored and
communicated using these systems. This, in turn, has led to a heightened awareness of the need to
a Lhese systems. This, in turn, has led to a heightened awareness of the need to
protect data and resources from disclosure, to guarantee the authenticity of data and
messages, and to protect systems from network-based attacks. Second, the disciplines of
a, and to protect systems from network-based attacks. Second, the disciplines of
cryptography and network security have matured, leading to the development of practical,
readilV available applications to enforce network security
, available applications to enforce network security.
It is the purpose of this book to provide a practical survey of network security applications and
standards. The emphasis is on applications that are widely used on the internet and for
corpot pplications that are widely used on the internet and for
corporate networks, and on standards (especially internet standards) that have been widely deployed.
This book is intended for both an academic and a professional audience. As a textbook, it is
intended as a one-semester undergraduate course on network security for computer science,
.raduate course on network security for computer science,
computer engineering, and electrical engineering majors. It covers the material in IASZ
Security Mechanisms. a core area in the information Technology body of knowledge; and
, ldechanisms, a core area in the information Technology body of knowledge; and
NET4 SecuritV, another core area in the information Technology body of knowledge. These
J, another core area in the information Technology body of knowledge. These
subject areas are part of the Draft ACM/IEEE Computer Society Computing Curricula 2005.
J part of the Draft ACM/IEEE Computer Society Computing Curricula 2005.
The book also serves as a basic reference volume and is suitable for self-study
J
The book is organized in three parts:
.anned in three parts:
Part One. Cryptography: A concise survey of the cryptographic algorithms and protocols
Jptography: A concise survey of the cryptographic algorithms and protocols
underlying network security applications, including encryption, hash functions, digital
J e network security applications, including encryption, hash functions, digital
.
signatures, and key exchange..
IX
x ~FACE
Part Two. Network Security APDlications: Covers imDortant network securitV tools and
J APPlications: Covers important network security tools and
applications, including Kerberos, X.509v3 certificates, PGP, S/MIME, lP Security,
SSL/TLS, SET, and SNMPv3.
Pad Three. System SecuritV: Looks at system-level security issues, including the threat of
J atem Security: Looks at system-level security issues, including the threat of
and countermeasures for intruders and viruses and the use of firewalls and trusted systems.
y items.
In addition, this book includes an extensive glossary, a list of frequently used acronyms,
and a bibliography. Each chapter includes homework problems, review questions, a list of
.Laphy. Each chapter includes homework problems, review questions, a list of
key words, suggestions for further reading, and recommended Web sites. In addition, a test
bank is available to instructors.
For this new edition, a tremendous amount of original supporting material has been made
available online in the following categories.
5 5
. Online chapters: To limit the size and cost of the book, two chapters of the book are
Piers: To limit the size and cost of the book, two chapters of the book are
provided in PDF format. This includes a chapter on SNMP security and one on legal
and ethical issues. The chapters are listed in this book's table of contents.
. Online appendices: There are numerous interesting topics that support material found
in the text but whose inclusion is not warranted in the printed text. Seven online
appendices cover these topics for the interested student. The appendices are listed in this
pies for the interested student. The appendices are listed in this
book's table of contents.
. Homework problems and solutions: TO aid the student in understanding the material,
problems and solutions: TO aid the student in understanding the material,
a separate set of homework problems with solutions are provided. These enable the
students to test their understanding of the text.
5
. Supporting documents: A variety of other useful documents are referenced in the text
pporting documents: A variety of other useful documents are referenced in the text
and provided online.
. Key papers: TWenty-Four DaDers from the Drofessional literature, manV hard to find,
J papers: FWenty-Four papers from the professional literature, many hard to find,
.,'
are provided for further reading.
Purchasing this textbook new grants the reader six months of access to this online
a Lhis textbook new grants the reader six months of access to this online
material.
To support instructors, the following materials are provided.
. Solutions Manual: Solutions to end-of-chapter Review Questions and Problems.
. Protects Manual: Suggested project assignments for all of the project categories listed
sects Manual: Suggested project assignments for all of the project categories listed
subsequently in this Preface.
1 J
. POwerPOint Slides: A set of slides covering all chapters, suitable for use in lecturing.
a all chapters, suitable for use in lecturing.
. PDF Files: Reproductions of all figures and tables from the book.
. Test Bank: A chaptenby-chapter set of questions.
All of these support materials are available at the instructor Resource Center (IRC)
for this textbook, which can be reached via pearsonhighered.com/stallings or by clicking
on the button labeled "Book info and More instructor Resources" at this book's Web site
.
PREFACE ac
local Prentice Hall sales representative via
..
fbI PaxraCE
changes while maintaining a broad and comprehensive coverage of the entire field. To begin
e e a broad and comprehensive coverage of the entire field. To begin
this process of revision, the third edition was extensively reviewed by a number of professors
who teach the subject. In addition, a number of professionals working in the field reviewed
,ect. In addition, a number of professionals working in the field reviewed
individual chapters. The result is that, in many places, the narrative has been clarified and
tightened, and illustrations have been improved. Also, a large number of new "field-tested"
problems have been added.
Beyond these refinements to improve pedagogy and user friendliness, there have been
.'
major substantive changes throughout the book. Highlights include:
. Pseudorandom number generation and Pseudorandom functions (rebused): The
treatment of this important topic has been expanded, with the addition of new material in
Chapter 2 and a new appendix on the subject.
pier 2 and a new appendix on the subject.
. Cartographic hash funchons and message authentication codes (rebused): The material
J ptographic hash funchons and message authentication codes (rebused): The material
on hash functions and MAC has been revised and reorganized to provide a clearer and
more sVstematic treatment.
y .tematic treatment.
. Key dsstribution and remote user authentication (revised): In the third edition, these
topics were scattered across three chapters. In the fourth edition, the material is revised
and consolidated into a single chapter to provide a unified, systematic treatment.
ale chapter to provide a unified, systematic treatment.
. Federated identity (new): A new section covers this common identity management
J
scheme across multiple enterprises and numerous applications and supporting many
thousands, even millions, of users.
. HTTPS (new): A new section covers this protocol for providing secure communication
between Web browser and Web server.
. Secure Shell (new): SSH, one of the most pervasive applications of encryption
technology, is covered in a new section.
by, is covered in a new section.
. DomainKeys identified Mail (new): A new section covers DKIM, which has become
Ja identified Mail (new): A new section covers DKIM, which has become
the standard means of authenticating e-mail to counter spurn.
e pain.
. Wireless network security (new): A new chapter covers this important area of network
y (new): A new chapter covers this important area of network
security The chanter deals with the IEEE 802.11 (WiFi) security standard for wireless
y. foe chapter deals with the IEEE 802.11 (WiFi) security standard for wireless
local area networks and the Wireless Application Protocol (WAP) security standard
pplication Protocol (WAP) security standard
for communication between a mobile Web browser and a Web server.
. IPsec (revised): The chapter on IPsec has been almost completely rewritten. It now
covers IPsecv3 and IKEv2. In addition, the presentation has been revised to improve
claritV and breadth.
y and breadth.
. Legal and ethical issues (new): A new online chapter covers these important topics.
. Online aPPendices (new): Six online appendices provide addition breadth and depth
for the interested student on a varietV of tooles.
J pies.
. Homework problems with solutions: A separate set of homework problems (with
solutions) is provided online for students.
, is provided online for students.
. Test bank: A test bank of review questions is available to instructors. This can be used
for ouizzes or to enable the students to check their understanding of the material.
1 5
. Firewalls (revised): The chapter on firewalls has been significantly expanded.
With each new edition, it is a struggle to maintain a reasonable page count while adding
new material. In part, this objective is realized by eliminating obsolete material and tightening
the narrative. For this edition, chapters and appendices that are of less general interest have
...
PREFACE xiII
been moved online as individual PDF files. This has allowed an expansion of material without
pansion of material without
the corresponding increase in size and price.
This book is adapted from Cryptography and Network Security, Fifth Edition (CNS5e). CNS5e
provides a substantial treatment of cryptography, including detailed analysis of algorithms and
.. ac.
a significant mathematical component, all of which covers 400 pages. Network Security
Essen.nificant mathematical component, all of which covers 400 pages. Network Security
Essentials:APDlications and Standards. Fourth Edition (NSE4e) provides instead a concise overview
PPlications and Standards, Fourth Edition (NSE4e) provides instead a concise overview
of these topics in Chapters 2 and 3. NSE4e includes all of the remaining material of CNS5e.
NSE4e also covers SNMP security, which is not covered in CNS5e. Thus, NSE4e is intended for
;, which is not covered in CNS5e. Thus, NSE4e is intended for
college courses and professional readers where the interest is primarily in the application of
e professional readers where the interest is primarily in the application of
network security and without the need or desire to delve deeplV into crVptographic theory and
J and without the need or desire to delve deeply into cryptographic theory and
..'
pnnciples.
This new edition has benefited from review by a number of people who gave generously
.
their time and expertise. The following people reviewed all or a large part of the manuscript:
.
Marius Zimand (Towson State University), Shambhu Upadhyaya (University of Buffalo),
Nan Zhang (George Washington University), Dongwan Shin (New Mexico Tech), Michael
a Lueorge Washington University), Dongwan Shin (New Mexico Tech), Michael
Kain (Drexel University), William Bard (University of Texas), David Arnold (Baylor
UniversitV), Edward Alien (Wake Forest University), Michael Goodrich (UC-lrvine),
y), Edward Alien (Wake Forest University), Michael Goodrich (UC-lrvine),
Xunhua Wang (James Madison University), Xianyang Li (illinois institute of Technology),
and Paul Jenkins (Brigham Young University).
Thanks also to the manV poODle who Drovided detailed technical reviews of one or more
y people who provided detailed technical reviews of one or more
chapters: Martin Bealby, Martin Hlavac (Department of Algebra, Charles University in Prague,
Czech Republic), Martin Rublik (BSP Consulting and University of Economics in Bratislava),
public), Martin Rublik (BSP Consulting and University of Economics in Bratislava),
Rafael Lara (President of Venezuela's Association for information Security and Cryptography
Research), Amitabh Saxena, and Michael Spratte (Hewlett-Packard Company). I would
), Amitabh Saxena, and Michael Spratte (Hewlett-Packard Company). I would
especially like to thank Nikhil Bhargava (liT Delhi) for providing detailed reviews of various
chapters of the book.
Nikhil Bhargava (liT Delhi) developed the set of online homework problems and
java (liT Delhi) developed the set of online homework problems and
solutions. Professor Sreekanth Malladi of Dakota State UniversitV developed the hacking
y developed the hacking
. R. n, n, ~ r n',,'.
exercises. 3an jay Rao and Ruben Torres of Purdue developed the laboratory exercises that
,ay Rao and Ruben Torres of Purdue developed the laboratory exercises that
appear in the IRC.
The following people contributed project assignments that appear in the instructor's
a people contributed project assignments that appear in the instructor's
supplement: Henning Schulzrinne (Columbia University), Cetin Kaya Koc (Oregon State
UniversitV), and David Balenson (Trusted information Systems and George Washington
J), and David Balenson (Trusted information Systems and George Washington
UniversitV). Kim McLaughlin developed the test bank.
, ). Kim McLaughlin developed the test bank.
FinallV, I would like to thank the manV poODle reSDonsible for the Dublication of the
J, 1 would like to thank the many people responsible for the publication of the
book, all of whom did their usual excellent lob. This includes my editor Tracy Dunkelberger
,oh. This includes my editor Tracy Dunkelberger
and her assistants Melinda Hagerty and Allison Michael. Also, Jake Warde of Warde
s y and Allison Michael. Also, Jake Warde of Warde
Publishers managed the reviews.
5
With all this assistance, little remains for which I can take full credit. However, I am
proud to say that, with no help whatsoever, I selected all of the quotations.
ABOUT THE AUTHOR
William Stallings has made a unique contribution to understanding the broad sweep of
techal has made a unique contribution to understanding the broad sweep of
technical developments in computer security, computer networking, and computer architecture.
He has authored 17 titles and, counting revised editions, a total of 42 books on various aspects
of these subjects. His writings have appeared in numerous ACM and IEEE publications,
,ects. His writings have appeared in numerous ACM and IEEE publications,
including the Proceedings Of the IEEE and ACM Computing Reviews.
a Lhe Proceedings Of the IEEE and ACM Computing Reviews.
He has 11 times received the award for the best Computer Science textbook of the
year from the Text and Academic Authors Association.
In over 30 years in the field. he has been a technical contributor, technical manager, and
J, ne has been a technical contributor, technical manager, and
an executive with several high-technology firms. He has designed and implemented both
.n-technology firms. He has designed and implemented both
TCP/IP-based and OSI-based Drotocol suites on a varietV of comnuters and oDerating systems,
protocol suites on a variety of computers and operating systems,
.
ranging from microcomputers to mainframes. As a consultant, he has advised government
.lug from microcomputers to mainframes. As a consultant, he has advised government
..
agencies, computer and software vendors, and major users on the design, selection, and use of
networking software and products.
a .oftware and products.
He created and maintains the Computer Sdence StUdeds Resource Site at WdriamStallings
.corn/StudentSupport.html. This site provides documents and links on a variety of subjects of
general interest to computer science students (and professionals). He is a member of the editorial
board of CrVDtologia, a scholarly journal devoted to all aspects of cryptology.
yptologia, a scholarly journal devoted to all aspects of cryptology.
Dr. Stallings holds a PhD from M.I.T. in Computer Science and a B.S. from Noire
ac holds a PhD from M.I.T. in Computer Science and a B.S. from Noire
Dame in electrical engineering.
aineering.
.
