Understanding Pki: Concepts, Standards, and Deployment Considerations

Was published in 2002 - over ten years ago. Ok, why did I buy it then? Because it appeared to be the only book I could find. Read about 80% of it. Lots of terminologies, not much in practical working examples, references a lot of RFC's (some of those RFC's are HUNDREDS of pages long). At the end, I still have much I do not know. Who knows, after I learn PKI, maybe I will write my own book!

This book does a terrific job of explaining how various applications can use PKI and what PKI requires from an infrastructure stapoint. Part III, Deployment COnsiderations, is exceptionally good at how can PKI can be used from a practical standpoint. Strikes just the right balance between theoretical and practical. Technical detail was totally sufficient for me and included everything up to but not including a discussion of the actual mathematics behind public key encyrption.Highly recommended!!

I would like to see more details, but otherwise - it is very nice introductory book.

I think this is the real question you should answer before to buy this book. If you are an IT project Manager in the security space, or a pre-sale guy used to join and drive round-tables and chat sessions where the security is the main topic, or even you you are used to hi-level discuss with CTOs around their security infrastructure, then this book might be useful for you. This is a very hi-level overview of the concepts that sits behind a Public Key Infrastructure, where "infrastructure" is the main point. There's nothing technical here inside, it's really focused on the concepts of a PKI, providing you all the terminology, the various different components and topics that a PKI includes and that you need to know, evaluate and choose when approaching a PKI implementation, but you will not find anything about the implementation itself, nothing that will explain how all these wonderful PKI theory and concepts are applied to the real world using the current technologies. I probably did a mistake myself when I bought this book, but I was at least expecting a bit more about SSL, TLS and similar protocols that are a fundamental element of any secure transaction and therefore of any security infrastructure, but I was wrong. Even accepted that this was something different then I expected, I didn't even find the writing style too good, being honest, I don't know how many times the authors use the expression "that is," to clarify a statement, but definitely too many, and in general I found the way used to describe the concepts to make this matter even more boring than normally is.

I've read many books on PKI and there are not many good ones out there. This one used to be the best among some very awful books, which wasn't saying much. It was excellent on covering the standards of PKI such as they exist, but otherwise said very little about installation, layout, protocols, and design, common problems, and real world solutions. Most of what they said was repeated multiple times throughout the book. Sometimes even on the very next paragraph. They took two/three pages just to say that the top down approach to PKI planning is better than slapping in a service just to support a single product. Stating the obvious didn't win any points with me. They discussed outdated or barely used protocols like SET, and didn't bother getting in depth at all with protocols that are in use like SSL. They discussed Single Sign On like a simple PKI install will solve all our problems, completely missing the outstanding problem of vendor interoperability. Active Directory and PKI are only mentioned in passing with no operational details. Get Klaus Schmeh's book or the Housley book instead.

+ The the book is very well structured and concepts are explained very clearly.- The print quality is quite poor

:)