arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2602.14539cs.CRcs.HCcs.SE
收藏

当安全性遇见可用性:后量子密码学API的实证研究

When Security Meets Usability: An Empirical Investigation of Post-Quantum Cryptography APIs

Royal Melbourne Institute of Technology(皇家墨尔本理工大学);University of Moratuwa(莫拉图瓦大学);ExeQuantum

Marthin Toruan, R. D. N. Shakya, Samuel Tseitkin, Raymond K. Zhao, Nalin Arachchilage

AI总结:

通过实证评估开发者与后量子密码学API的交互,识别影响可用性的认知因素,并提出改进建议以促进PQC的采用。

摘要:

量子计算的进步日益威胁当前密码系统(特别是依赖公钥密码的系统)所保护数据的安全性和隐私。为此,国际网络安全界优先实施后量子密码学(PQC),这是一种旨在抵抗量子攻击同时在经典计算机上运行的新密码标准。美国国家标准与技术研究院(NIST)已标准化了多种PQC算法,并计划在2035年前弃用经典非对称方案(如RSA和ECDSA)。尽管紧迫,PQC的采用仍然缓慢,通常是由于开发者专业知识有限。应用程序编程接口(API)旨在弥合这一差距,然而先前关于经典安全API的研究表明,密码学API的可用性差可能导致开发者在实现应用时引入漏洞,而PQC的新颖性和复杂性加剧了这一风险。迄今为止,PQC API的可用性尚未得到系统研究。本研究对PQC API的可用性进行了实证评估,观察开发者在软件开发任务中如何与API和文档交互。研究识别了影响开发者在最少入门条件下使用PQC原语时的认知因素。研究结果强调了PQC生态系统中改进面向开发者的指南、术语对齐和工作流示例的机会,以更好地支持非专家用户。

英文摘要:

Advances in quantum computing increasingly threaten the security and privacy of data protected by current cryptosystems, particularly those relying on public-key cryptography. In response, the international cybersecurity community has prioritized the implementation of Post-Quantum Cryptography (PQC), a new cryptographic standard designed to resist quantum attacks while operating on classical computers. The National Institute of Standards and Technology (NIST) has already standardized several PQC algorithms and plans to deprecate classical asymmetric schemes, such as RSA and ECDSA, by 2035. Despite this urgency, PQC adoption remains slow, often due to limited developer expertise. Application Programming Interfaces (APIs) are intended to bridge this gap, yet prior research on classical security APIs demonstrates that poor usability of cryptographic APIs can lead developers to introduce vulnerabilities during implementation of the applications, a risk amplified by the novelty and complexity of PQC. To date, the usability of PQC APIs has not been systematically studied. This research presents an empirical evaluation of the usability of the PQC APIs, observing how developers interact with APIs and documentation during software development tasks. The study identifies cognitive factors that influence the developer's performance when working with PQC primitives with minimal onboarding. The findings highlight opportunities across the PQC ecosystem to improve developer-facing guidance, terminology alignment, and workflow examples to better support non-specialists.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑