CAREER: Cryptography Outside the Box

密码学是在潜在对手在场的情况下进行通信的科学，是计算机安全中的一个重要组成部分。过去三十年的密码学研究继续对社会产生巨大影响，例如，实现了全球范围的ATM网络、付费电视、私人电子邮件、VPN和电子商务。这个项目正在开发更加用户友好、容错和安全的密码学，从而扩大它在我们日益电子化的生活中的适用性。更具体地说，过去对密码学的研究虽然非常成功，但对密码构造的运行环境做出了许多隐含的假设。这样的假设在实际部署中往往被证明是不正确的，导致了严重的安全漏洞。这个项目专注于使密码学摆脱以下不切实际的假设：用户拥有统一随机的长密钥，这些密钥被完美地记住，永远不会意外泄露给对手，并且用于不会泄露信息的计算设备。仅举一个例子，对于无法记住千位长密钥的真实用户，几乎没有做过什么工作来定制密码方案。因此，尽管取得了所有密码方面的成就，但今天最常用的用户身份验证方法是通过密码。目前使用的密码不能提供良好的安全性，也不会给用户带来不必要的不便。该项目正在开发密码的替代方案，以增强安全性和用户便利性。它正在开发不需要存储生物特征模板的生物特征识别方法，从而降低隐私风险。它还在研究使用小型廉价硬件令牌向授权人员打开虚拟门的可能性，类似于如何使用物理钥匙打开物理门。该项目还研究了从安全漏洞中优雅地自动恢复的技术，例如未经授权泄露密码或密钥。除了创新的密码学研究外，该项目的教育部分侧重于使学生能够严格地思考计算机安全，并能够批判性地评估各种(通常是不合理的)安全声明。

Cryptography is the science of communication in the presence of a potential adversary and is an essential component in computer security. The past three decades of the study of cryptography continue to have a tremendous impact on society, having enabled, for example, world-wide ATM networks, pay TV, private email, VPNs, and electronic commerce. This project is developing cryptography that is more user-friendly, fault-tolerant and secure, thus broadening its applicability to our increasingly electronic lives.More specifically, the past study of cryptography, while very successful, has made many implicit assumptions about the environments in which cryptographic constructions operate. Such assumptions often turn out to be untrue in real-life deployments, resulting in serious securityvulnerabilities. This project focuses on freeing cryptography of the following unrealistic assumptions: that users have uniformly random long keys, which are remembered perfectly, never accidentally disclosed to the adversary, and used in computing devices that leak no information.As just one example, little work has been done on tailoring cryptographic schemes to real users, who cannot remember thousand-bit-long secret keys. Thus, despite all cryptographic achievements, the most commonly used method of user-authentication today is via passwords. Passwords, as theyare currently used, do not provide good security and inconvenience users unnecessarily. This project is developing alternatives to passwords that enhance security and user convenience. It is developing means of biometrics identification that do not require storage of the biometric template, thus reducing privacy risks. It is also studying the possibilities of using small inexpensive hardware tokens for opening virtual doors to those authorized, similarly to how physical keys are used to open physical doors. This project is also studying techniques that will recover gracefully and automatically from security breaches, such as unauthorized disclosure of passwords or keys.In addition to innovative cryptographic research, the educational components of the project focus on enabling students to think rigorously about computer security and to be able to critically evaluate various (often unjustified) security claims.