CAREER: Identifying, quantifying, and explaining design principles and user practices that enable effective long-term key management

许多与安全相关的新技术有可能彻底改变个人的生活-例如，加密货币。然而，这些技术的采用由于依赖于需要用户管理加密密钥（长随机字符串）而受到阻碍。之前的研究表明，用户很难管理加密密钥，现有的密钥管理系统通常会导致比解决更多的问题。为了改进密钥管理的设计，本项目研究密钥管理如何在真实的世界中使用。这些研究的数据有助于确定哪些设计最能促进实用性，可用性和安全性，哪些设计未能做到这一点，以及需要什么新的设计。该项目可以提高我们对如何设计可以与安全相关技术集成的密钥管理系统的理解，以增加其被采用的机会。研究结果被用于为大学和K-12学生更新和生成新的课程，帮助教育和培养下一代网络安全专家。该项目将对社会福利和国防产生积极影响。该项目包括收集有关依赖密钥管理的现有系统的实用性，可用性和安全性的定量和定性数据。数据收集自成功采用密钥管理系统的用户，例如使用端到端电子邮件加密的开发人员和首次采用密钥管理系统的新手用户。这些研究检查了一般使用情况，使用情况如何随时间变化，用户如何管理多个加密密钥，如何在设备之间同步密钥，以及如何恢复对丢失密钥的访问。方法包括访谈、调查、观察性研究和可用性研究。在整个研究过程中确定的设计原则将在一个面向公众的网站上展示，该网站以易于密码系统供应商和其他研究人员理解的方式综合了该项目的结果。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Many new security-related technologies have the potential to revolutionize individuals’ lives—for example, cryptocurrencies. However, the adoption of these technologies is stymied by their reliance on needing users to manage cryptographic keys (long strings of random characters). Prior research has shown users struggle to manage cryptographic keys, with existing key management systems often causing more problems than they solve. To improve the design of key management, this project investigates how key management is used in the real world. Data from these studies help identify which designs best promote utility, usability, and security, which designs fail to do so, and what new designs are needed. This project can improve our understanding of how to design key management systems that can be integrated with security-related technologies to increase their chance of being adopted. Results are being used to update and generate new curricula for university and K–12 students, helping educate and prepare the next generation of cybersecurity experts. The project will positively impact societal welfare and national defense.This project includes collecting quantitative and qualitative data about the utility, usability, and security of existing systems that rely on key management. Data are gathered from users who have successfully adopted key management systems, such as developers using end-to-end email encryption and novice users adopting a key management system for the first time. The studies examine general usage, how usage changes over time, how users manage multiple cryptographic keys, how they synchronize keys between devices, and how they recover access to lost keys. Methods include interviews, surveys, observational studies, and usability studies. Design principles identified throughout this research will be presented on a public-facing website that synthesizes this project’s results in a manner easily digested by cryptographic system vendors and other researchers.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.