Securing the Foundations of Security

密码工具已成为计算机和通信安全的一个组成部分。虽然这些工具的使用对于实现安全目标通常是必要的，但是基于安全密码原语构建的方案和协议本身也可能不安全。最近广为人知的攻击，如Logjam和POODLE，表明安全性取决于密码原语，协议和系统设计，实现和配置的数学安全保证之间的复杂相互作用。虽然没有一种灵丹妙药可以在使用密码术的复杂信息和通信系统中提供安全保证，但重要的是开发使上述安全系统的各个方面之间的相互作用更加透明的技术和工具。我的研究集中在前两个方面之间的关系，与开发密码和正式的工具，这将使它更容易验证，使用安全的密码原语设计的方案和协议实现其安全目标的目标。我将通过应用可证明安全性、逻辑、概率、计算信息论、决策论和优化技术来做到这一点。

Cryptographic tools have become an integral part of computer and communication security. While the use of these tools is often necessary for achieving security goals, it is also the case that schemes and protocols built upon secure cryptographic primitives may themselves fail to be secure. Recent well-publicized attacks, such as Logjam and POODLE, demonstrate that security depends on a complex interaction between mathematical security guarantees for cryptographic primitives, protocol and system design, implementation, and configuration. While there is no single magic bullet which will provide security assurance in complex information and communication systems which use cryptography, it is important to develop techniques and tools which make the interaction between the various aspects of security systems described above more transparent. My research focuses on the relationship between the first two of these aspects, with the goal of developing cryptographic and formal tools which will make it easier to verify that schemes and protocols designed using secure cryptographic primitives achieve their security goals. I will do this by applying techniques from provable security, logic, probability, computational information theory, decision theory, and optimization.