CAREER: Cryptographic Tools for Usable Human Authentication

密码身份验证是用户感到沮丧的常见来源，也是安全漏洞的持续来源。用户在为多个不同帐户创建和记住密码的繁重任务中苦苦挣扎，并经常通过选择弱(低熵)密码并在多个帐户中重复使用相同的密码来应对。在过去的十年里，许多知名组织的数据泄露事件使数十亿这样的低熵密码暴露在离线暴力攻击的危险威胁之下。尽管有缺点，密码仍然是最广泛采用的身份验证形式。该项目的目标是开发加密工具，以提高人类身份验证，特别是密码身份验证的安全性和可用性。该项目研究新的组合技术来设计和分析内存硬函数，这是一种可用于保护密码和生物识别等低熵秘密免受暴力攻击的加密原语。该项目开发了更强大的内存硬盘功能，并分析了现有的内存硬盘函数Scret、Argon2、DRSample的具体安全性。该项目采用了统计学和博弈论的工具，以更好地了解用户选择的密码的分布情况，并预测密码攻击者的行为。调查人员研究了如何根据这种分布来调整密码防御，以最佳地保护用户帐户免受攻击者的攻击。最后，该项目开发了帮助用户(逐渐)记住更强大的密码的机制，并帮助用户安全地管理多个密码，而不需要用户记住每个帐户的独立密码。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Password authentication is a common source of frustration for users and a constant source of security vulnerabilities. Users struggle with the burdensome task of creating and remembering passwords for multiple different accounts and frequently cope by selecting weak (low-entropy) passwords and reusing the same password across multiple accounts. Over the past decade data breaches at many prominent organizations have exposed billions of these low-entropy passwords to the dangerous threat of offline brute-force attacks. Despite their shortcomings passwords continue to be the most widely adopted form of authentication. The goal of the project is to develop cryptographic tools to improve the security and usability of human authentication, especially password authentication. The project investigates new combinatorial techniques to design and analyze memory hard functions, a cryptographic primitive which can be used to protect low-entropy secrets such as passwords and biometrics against brute-force attacks. The project develops stronger memory hard functions and analyzes the concrete security of prior memory hard functions such as SCRYPT, Argon2 and DRSample. The project adapts tools from statistics and game theory to better understand the distribution over user chosen passwords and predict how password attackers will behave. The investigators study how password defenses can be tuned based on this distribution to optimally protect user accounts against attackers. Finally, the project develops mechanisms to help users (gradually) memorize stronger passwords and to help users securely manage multiple passwords without requiring users to memorize independent passwords for every account.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.