TWC: Medium: Collaborative: Measuring and Improving the Management of Today's PKI

公钥基础设施（PKI）以及安全套接字层（SSL）和传输层安全（TLS）协议负责保护互联网交易，如银行、电子邮件和电子商务；它们为用户提供了验证在线通信对象的能力，并支持对这些通信进行加密。虽然PKI的使用主要是自动化的，但在管理任务中仍有大量的人为干预，这些干预对PKI的正确操作至关重要。因此，出现了许多PKI管理不善损害最终用户安全的情况。这个项目正在开发技术，以更好地理解和改善PKI的管理，帮助更好地保护互联网。该项目有四个研究重点，每个重点都研究了PKI中不同参与者所面临的管理挑战：内容分发网络（CDN）管理员、证书颁发机构（ca）、最终用户和非web协议。首先，该项目正在进行测量，以更好地了解站点与其cdn之间共享私钥的频率，并提高这种做法的安全性。其次，该项目正在为证书颁发机构制定新的激励措施，以确保有关其被吊销证书的信息能够传达给最终用户。第三，该项目旨在更好地了解PKI将如何随着物联网（IoT）的发展而发展，以及PKI被迫快速扩展。第四，该项目将扩展现有的测量方法，以了解非web协议（例如IMAPS）中PKI管理的困难，这些协议传统上维护得不太好。

The Public Key Infrastructure (PKI), along with the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, are responsible for securing Internet transactions such as banking, email, and e-commerce; they provide users with the ability to verify with whom they are communicating online, and enable encryption of those communications. While the use of the PKI is mostly automated, there is a surprising amount of human intervention in management tasks that are crucial to its proper operation. As a result, there have been numerous instances where mismanagement of the PKI has harmed the security of end users. This project is developing techniques to better understand and improve the management of the PKI, helping to better secure the Internet.This project has four research foci, each examining the management challenges faced by different players in the PKI: Content Distribution Network (CDN) administrators, Certificate Authorities (CAs), end-users, and non-Web protocols. First, the project is conducting measurements to better understand the frequency of sharing private keys between sites and their CDNs, and to improve the security of this practice. Second, the project is developing new incentives for CAs to ensure information about their revoked certificates reach end users. Third, the project is aiming to better understand how the PKI will evolve as the Internet of Things (IoT) grows and the PKI is forced to quickly scale up. Fourth, the project will expand existing measurement approaches to understand the difficulties of PKI management in non-Web protocols (e.g., IMAPS), which have traditionally been less-well maintained.