Good resources for learning cryptography and OpenSSL?

You probably don't want to be working at the level of selecting from among several encryption algorithms, digital signature primitives, etc. That's too low-level, and it requires too much crypto knowledge to get everything right.

Instead, you want to be selecting from full protocols that other have vetted: e.g., TLS, OpenPGP, OpenID, OAuth, etc. There the authors of the protocols have already done the work of figuring out how to piece together the encryption/signing algorithms into a full protocol, and those protocols have been carefully vetted by knowledgeable cryptographers. Therefore, if you can possibly use some existing vetted scheme like this, you will be much better off (and much less likely to have subtle flaws in your crypto).

If I had to recommend one book for the practicing programmer, I would recommend Cryptography Engineering: Design Principles and Practical Applications by Ferguson, SChneier, and Kohno. It is fantastic. But it also describes design of cryptographic schemes at a rather lower level than you probably want to be working, if at all possible.


The usual recommendation: the Handbook of Applied Cryptography. Very good and serious reading, and downloadable for free. It is relatively heavy in math contents, but, let's face it, cryptography is a highly technical subject which suffers from a lack of testability (you cannot easily test whether a given algorithm or protocol is secure) so you cannot realistically make sensible decisions about it without understanding at least part of the implied mathematics (especially the stuff about complexity).