WWW Security Pointers

This page had some useful references for Jon Rochlis and Dan Geer's WWW Security Tutorial, in 1996 but is now hopelessly out of date.

• Introduction
  • Distribution of Servers
• Client Server Network Security Basics
  • Security and Encryption from Yahoo
• Basic WWW Security
  • WWWFAQ
  • W3 Consortium's home page
  • WWW security directory from Yahoo
  • The WWW Security FAQ
  • HTTP Security Resources from W3C
• Cryptography
  • Cryptography FAQ
• Network Layer Security
  • SSL
    • Netscape's overview 
    • Version2
    • Version 3
    • Easy to read description of the protocol.
    • Reference/sample implementations
      • SSLRef from Netscape
      • SSLeay and SSLapps from Eric Young and Tim Hudson from Australia
  • PCT
  • IPSec IETF working group, including RFC's.
    • RFC 1825 (arch)
    • RFC 1826 (authentication header - AH)
    • RFC 1827 (encapsulating security payload - ESP)
    • RFC 1828 (AH w/ MD5) required
    • RFC 1829 (ESP w/DES-CBC) required
• Advanced WWW Security
  • EIT's Secure HTTP
  • Java
    • general Java security info
    • Java Security FAQ from Princeton
    • detailed paper on java flaws from Princeton
  • Payment Systems
    • First Virtual has a simple, low-assurance, no-cryptography system aimed at letting the masses sell information.
    • Secure Electronic Transactions (SET) specifications for credit card security
    •  OpenMarket's merchant services
    • Digicash's electronic cash.
    • Cybercash's credit card protection.
  • Misc issues
    • firewalls
    • configuration
    • logging