CAREER: Identifying, quantifying, and explaining design principles and user practices that enable effective long-term key management

许多与安全相关的新技术有可能彻底改变个人的生活--例如，加密货币。然而，这些技术的采用受到它们对需要用户管理加密密钥(长随机字符串)的依赖的阻碍。先前的研究表明，用户很难管理加密密钥，现有的密钥管理系统经常造成比他们解决的问题更多的问题。为了改进密钥管理的设计，本项目调查了密钥管理如何在现实世界中使用。这些研究的数据有助于确定哪些设计最能促进实用性、可用性和安全性，哪些设计无法做到这一点，以及需要哪些新设计。这个项目可以提高我们对如何设计可以与安全相关技术集成的密钥管理系统的理解，以增加它们被采用的机会。结果正被用于更新和编制大学和K-12学生的新课程，帮助教育和准备下一代网络安全专家。该项目将对社会福利和国防产生积极影响。该项目包括收集有关依赖密钥管理的现有系统的实用性、可用性和安全性的定量和定性数据。数据收集自已成功采用密钥管理系统的用户，例如使用端到端电子邮件加密的开发人员和首次采用密钥管理系统的新手用户。这些研究检查了一般使用情况，使用情况如何随时间变化，用户如何管理多个加密密钥，他们如何在设备之间同步密钥，以及他们如何恢复对丢失密钥的访问。方法包括访谈、调查、观察性研究和可用性研究。在整个研究过程中确定的设计原则将在一个面向公众的网站上展示，该网站以加密系统供应商和其他研究人员易于理解的方式综合了该项目的结果。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Many new security-related technologies have the potential to revolutionize individuals’ lives—for example, cryptocurrencies. However, the adoption of these technologies is stymied by their reliance on needing users to manage cryptographic keys (long strings of random characters). Prior research has shown users struggle to manage cryptographic keys, with existing key management systems often causing more problems than they solve. To improve the design of key management, this project investigates how key management is used in the real world. Data from these studies help identify which designs best promote utility, usability, and security, which designs fail to do so, and what new designs are needed. This project can improve our understanding of how to design key management systems that can be integrated with security-related technologies to increase their chance of being adopted. Results are being used to update and generate new curricula for university and K–12 students, helping educate and prepare the next generation of cybersecurity experts. The project will positively impact societal welfare and national defense.This project includes collecting quantitative and qualitative data about the utility, usability, and security of existing systems that rely on key management. Data are gathered from users who have successfully adopted key management systems, such as developers using end-to-end email encryption and novice users adopting a key management system for the first time. The studies examine general usage, how usage changes over time, how users manage multiple cryptographic keys, how they synchronize keys between devices, and how they recover access to lost keys. Methods include interviews, surveys, observational studies, and usability studies. Design principles identified throughout this research will be presented on a public-facing website that synthesizes this project’s results in a manner easily digested by cryptographic system vendors and other researchers.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.