Skip to content

Back to the catalog

bencteux.frwriteup

Serious Cryptography (book review)

A detailed personal review of the first edition of 'Serious Cryptography: A Practical Introduction to Modern Encryption' by Jean-Philippe Aumasson (No Starch Press, 2017), aimed at non-cryptographer engineers. The reviewer highlights the book's chronological structure from basic concepts through symmetric and asymmetric crypto to post-quantum cryptography, praising its accessible AES walkthrough, MAC vs HMAC distinctions, elliptic curve explanations, and 'How things can go wrong' sections that tie real implementation pitfalls to actual vulnerabilities — useful reference material for vulnerability researchers and pentesters needing solid crypto fundamentals.

TL;DR Personal review of Jean-Philippe Aumasson's 'Serious Cryptography', a practical crypto book praised for its accessible AES/elliptic-curve/post-quantum explanations and real-world implementation pitfalls relevant to pentesters.
Open original ↗
Document

What it is

A review of the first edition (2017) of Jean-Philippe Aumasson's Serious Cryptography (No Starch Press, 282 pages / 269 of technical content), written by an engineer who advises on security without a mathematics background. The one detail worth acting on that the summary omits: the reviewer read only the 1st edition, but flags that a 2nd edition shipped in 2024 at $59.99, adding material such as Chapter 15: Cryptocurrency Cryptography and (per the reviewer's expectation) other post-2017 updates.

What to do

If you're buying, this maps the edition choice for you:

  • Want current coverage (cryptocurrency crypto, post-2017 updates) → buy the 2nd edition, 2024, $59.99.
  • Want the core material cheaply → a second-hand 1st edition covers everything the review praises; the reviewer notes it can be had "much cheaper."

The review does not state the 1st-edition second-hand price.

Who it's for

The reviewer positions the book squarely for engineers/pentesters who need to advise on what is secure without deriving the math. Concretely useful specifics the summary doesn't surface:

  • Threat-model framing — the early chapters distinguish attacker prerequisites per scenario, including replay attacks (resending cryptographic material), which the reviewer notes the pentester community covers less than the usual MitM examples.
  • AES is used as the guiding worked example in the block-ciphers chapter, dissected in full.
  • MAC vs HMAC distinctions are called out as a standout section in the keyed-hashing chapter.
  • The "How things can go wrong" sections include annotated real implementation code tied to actual historical vulnerabilities — the part most relevant to vuln researchers.

Caveats

The reviewer explicitly admits limited comparison ("I did not read a lot of other books on cryptography"), so the "best I've read" verdict is weakly grounded. All chapter-content claims here are based on the 1st edition only; the reviewer is inferring, not confirming, the 2nd edition's additions beyond Chapter 15.

Organisations named here

  • Jean-Philippe Aumasson

Techniques named here

  • Man in The Middle
  • Replay attack
  • AES
  • MAC vs HMAC
  • Elliptic curve cryptography
  • RSA
  • TLS implementation
  • Post-quantum cryptography

Related in Learning