Secure Electronic Commerce review

Subtitled 'Building the Infrastructure for Digital Signatures and Encryption', you could be forgiven for thinking that you're in for a heavy-duty trip down the extremely complex road that is PKI (public key infrastructure). Forgiven but incorrect, because this is less of a hard-core technical reference and hands-on reference guide, and more of an introduction to the whole arena of secure e-commerce development.

Taken in the light of the latter viewpoint, it's actually not a bad read. This is especially true for the less experienced developer in need of a crash course in digital signatures for secure transaction, PKI and certification policies, IPSec, Virtual Private Networking, secure messaging and S/MIME, for example. Yet even they surely wouldn't need the padding that kicks the book off. If you don't already know enough to put the Internet, its applications and communities into the right perspective regarding e-commerce and transaction security, then perhaps you need to re-evaluate exactly why you're doing the job you are.

The more experienced developer will quickly become disillusioned with the lack of decent real-world, hands-on code examples. Like most geeks, I always head straight for the back of a reference book to see how the appendices stand up, or in this case fall down. The first appendix covers forms of agreement for e-commerce, which is great if you're interested in US law as it applies to online transactional processes, but not so hot otherwise. The same applies to the next appendix, devoted to the US Federal E-Sign Act. Things improve with some meaty coverage of ASN.1 notation and X.509 version 3 certificate format usage, and later pages looking at legacy application security standards such as PEM, X.400 and Secure HTTP, and another on public key cryptosystems.

The book is touted as a meeting of technical and legal minds, but to be honest most of the legal content is approached resolutely from the US perspective, with an obligatory nod towards Europe. If you're interested in the US Federal E-Sign Act or the Electronic Funds Transfer Act, then you'll be happy - possibly. It isn't even saved by the technical content, which just doesn't get technical enough. If you're looking for a book that really gets down and dirty with PKI structural technicalities, this isn't it.