CAREER: Cryptographic Tools for Usable Human Authentication

密码身份验证是用户感到沮丧的常见原因，也是安全漏洞的持续来源。用户需要为多个不同的帐户创建和记住密码，这是一项繁重的任务，并且经常通过选择弱（低熵）密码并在多个帐户中重复使用相同的密码来科普。在过去的十年中，许多知名组织的数据泄露事件使数十亿个低熵密码暴露在离线暴力攻击的危险威胁之下。尽管存在缺点，密码仍然是最广泛采用的身份验证形式。该项目的目标是开发密码工具，以提高人类身份验证，特别是密码身份验证的安全性和可用性。该项目研究了新的组合技术来设计和分析内存硬函数，这是一种密码学原语，可用于保护低熵秘密，如密码和生物特征免受暴力攻击。该项目开发了更强的内存硬函数，并对已有的SCRYPT、Argon2和DRSample等内存硬函数的具体安全性进行了分析。该项目采用了统计学和博弈论的工具，以更好地了解用户选择的密码的分布情况，并预测密码攻击者的行为。研究人员研究如何根据此分布调整密码防御，以最佳地保护用户帐户免受攻击者的攻击。最后，该项目开发机制来帮助用户（逐渐）记住更强的密码，并帮助用户安全地管理多个密码，而无需要求用户记住每个帐户的独立密码。该奖项反映了NSF的法定使命，并且通过使用基金会的智力价值和更广泛的影响力审查标准进行评估，被认为值得支持。

Password authentication is a common source of frustration for users and a constant source of security vulnerabilities. Users struggle with the burdensome task of creating and remembering passwords for multiple different accounts and frequently cope by selecting weak (low-entropy) passwords and reusing the same password across multiple accounts. Over the past decade data breaches at many prominent organizations have exposed billions of these low-entropy passwords to the dangerous threat of offline brute-force attacks. Despite their shortcomings passwords continue to be the most widely adopted form of authentication. The goal of the project is to develop cryptographic tools to improve the security and usability of human authentication, especially password authentication. The project investigates new combinatorial techniques to design and analyze memory hard functions, a cryptographic primitive which can be used to protect low-entropy secrets such as passwords and biometrics against brute-force attacks. The project develops stronger memory hard functions and analyzes the concrete security of prior memory hard functions such as SCRYPT, Argon2 and DRSample. The project adapts tools from statistics and game theory to better understand the distribution over user chosen passwords and predict how password attackers will behave. The investigators study how password defenses can be tuned based on this distribution to optimally protect user accounts against attackers. Finally, the project develops mechanisms to help users (gradually) memorize stronger passwords and to help users securely manage multiple passwords without requiring users to memorize independent passwords for every account.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.