Dartmouth College Dartmouth Digital Commons Dartmouth College Ph.D Dissertations Theses and Dissertations 8-1-2008 Attribute-Based, Usefully Secure Email Christopher P. Masone Dartmouth College Follow this and additional works at: https://digitalcommons.dartmouth.edu/dissertations Part of the Computer Sciences Commons Recommended Citation Masone, Christopher P., "Attribute-Based, Usefully Secure Email" (2008). Dartmouth College Ph.D Dissertations. 26. https://digitalcommons.dartmouth.edu/dissertations/26 This Thesis (Ph.D.) is brought to you for free and open access by the Theses and Dissertations at Dartmouth Digital Commons. It has been accepted for inclusion in Dartmouth College Ph.D Dissertations by an authorized administrator of Dartmouth Digital Commons. For more information, please contact [email protected]. Attribute-Based, Usefully Secure Email A Thesis Submitted to the Faculty in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computer Science by Christopher P. Masone DARTMOUTH COLLEGE Hanover, New Hampshire August, 2008 Examining Committee: (chair) Sean W. Smith, Ph.D. David F. Kotz, Ph.D. Christopher J. Bailey-Kellogg, Ph.D. Denise L. Anthony, Ph.D. M. Angela Sasse, Ph.D. Charles K. Barlowe, PhD Dean of Graduate Studies Abstract A secure system that cannot be used by real users to secure real-world processes is not really secure at all. While many believe that usability and security are diametrically opposed, a growing body of research from the field of Human-Computer Interaction and Security (HCISEC) refutes this assumption. All researchers in this field agree that focusing on aligning usability and security goals can enable the design of systems that will be more secure under actual usage. We bring to bear tools from the social sciences (economics, sociology, psychology, etc.) not only to help us better understand why deployed systems fail, but also to enable us to accurately characterize the problems that we must solve in order to build systems that will be secure in the real world. Trust, a critically important facet of any socio-technical secure system, is ripe for analysis using the tools provided for us by the social sciences. There are a variety of scopes in which issues of trust in secure systems can be stud- ied. We have chosen to focus on how humans decide to trust new correspondents. Current secure email systems—such as S/MIME and PGP/MIME—are not expressive enough to capture the real ways that trust flows in these sorts of scenarios. To solve this problem, we begin by applying concepts from social science research to a variety of such cases from interesting application domains; primarily, crisis management in the North American power grid. We have examined transcripts of telephone calls made between grid manage- ment personnel during the August 2003 North American blackout and extracted several different classes of trust flows from these real-world scenarios. Combining this knowl- edge with some design patterns from HCISEC, we develop criteria for a system that will enable humans apply these same methods of trust-building in the digital world. We then present Attribute-Based, Usefully Secure Email (ABUSE) and not only show that it meets our criteria, but also provide empirical evidence that real users are helped by the system. ii Acknowledgments When I was born, my family began saving money with which to send me to college. What- ever college I wanted. It was important, my parents believed, that my intellect and my drive be the only limiting factors on my education. They wanted me to have the freedom to pursue every opportunity that my mind could earn me; because of their hard work and sacrifice, I was able to. I would not have been able to complete this dissertation without the help of a myriad of people, all of whom I try to remember and thank in the next few paragraphs of text. I would not have even been able to start without the support of my mother and father. Like many PhD students, I started graduate school with nebulous research goals. I knew that I wanted to work in systems; I liked building things, and the chalk dust in the theory labs made me sneeze. I drifted somewhat until, in Sean Smith’s Security and Privacy topics class, I read “Why Johnny Can’t Encrypt,” Whitten and Tygar’s seminal work in the area of security and usability. I was intrigued by this intersection of people and programs, and asked Sean if I could join his research group to study the wonderful and vexing problems that arise when the messy real world intrudes upon the clean-room of academic Computer Science. As my advisor, Sean has been unfailingly supportive, believing in me even when I didn’t believe in myself. As I barreled towards my defense, his willingness to adapt to my feast-or-famine work schedule provided me with a constant source of feedback on my text, making this document far better than it would have been otherwise. I cannot tell him how much his help has meant to me. My entire committee deserves to be acknowledged for their participation in my re- search, but I thank Denise Anthony and Angela Sasse especially for their help in under- standing the social science research that played such an important role in my work. Fur- thermore, I would have been lost without Denise’s help in designing my user studies and evaluating the resulting data. I also want to thank my colleagues from the Trustworthy Cyber Infrastructure for the Power Grid project, especially Matt Davis, Peter Sauer and Tom Overbye; their power grid domain knowledge proved invaluable when fleshing out the setup of my power-grid-based user study. On a broader scale, I owe a debt of gratitude to Simson Garfinkel and Alma Whitten, whose HCISEC work inspired and guided my own research. I can only hope that some future student reads my work as closely as I have read theirs. On a more personal level, I must thank my colleague and friend Sara Sinclair for her unfailing cheer, her ever-present shoulder, her enthusiasm for white-board brainstorming, and for roping me into the most rewarding experience of my graduate school career. I iii thank my interns Kate Bailey and Linden Vongsathorn for allowing me to mother them incessantly, I thank my lab mates for providing me with coffee conversation and imple- mentation advice, and I thank the College for providing me with ten years of unparalleled academic opportunity. Lastly, I thank my doctor and friend Kari Gleiser. Of all the work I have done in the six years since I started my PhD, the work I have done with her has been the most difficult, and the most valuable. I thank her for not only helping me weather the stress and despair that accompanies many courses of doctoral study, but also for the person that I have become through the time we have spent together. This dissertation has been the most massive project I have ever undertaken, and inspi- ration and assistance may have come from corners that I have failed to enumerate here. To those people as well, I offer my apologies and, again, my gratitude. This research was supported in part by the NSF (under grants CNS-0448499 and CNS- 0524695) and by Cisco. The views and conclusions do not necessarily reflect those of the sponsors. Hanover, NH August 2008 iv Preface Code for ABUSE is available upon request. Contact information: The author: [email protected] • His advisor, Sean Smith: [email protected] • v Contents 1 Introduction 1 1.1 Enabling technologies . 2 1.1.1 Public key cryptography: a building block . 2 1.1.2 Public Key Infrastructure (PKI) . 4 1.2 Motivation . 9 1.2.1 When identity is not enough . 9 1.2.2 Using scenarios from the power grid . 10 1.2.3 Current coping strategies are not good enough . 11 1.3 Humans and their trust . 12 1.3.1 Our notion of trust . 12 1.3.2 Reliance . 13 1.3.3 Signals . 13 1.3.4 Using this framework . 13 1.4 Requirements for a trustworthy email system . 14 1.4.1 Attacks in a trustworthy email system . 16 1.4.2 Usability: the last criterion . 17 1.4.3 The Problem . 18 1.5 ABUSE Overview . 18 1.6 Contributions . 20 1.7 Thesis Outline . 21 2 Patterns of trust flow 22 2.1 Trust flows . 23 2.2 Power Grid Background . 25 2.2.1 The blackout . 25 2.2.2 Power Grid Organizations . 26 2.2.3 Power Jobs . 27 2.3 Trust flow patterns . 28 vi 2.3.1 Role-based trust . 29 2.3.2 Simple delegation . 30 2.3.3 Coopetition . 32 2.3.4 Non-contemporaneous trust . 34 2.4 Conclusions . 35 3 Characteristics of a Solution 36 3.1 Possible approaches . 37 3.1.1 Algorithmically deciding the email trust problem . 37 3.1.2 Heuristically deciding the email trust problem . 39 3.1.3 Taking a user-centric approach . 40 3.2 Design criteria for usably secure software . 40 3.2.1 General patterns . 41 3.2.2 Patterns specifically applicable to secure/trustworthy email . 43 3.2.3 Remaining, inapplicable patterns . 45 3.3 Wrap-up . 45 4 Related Work 47 4.1 Secure/Trustworthy email technologies . 47 4.1.1 S/MIME . 48 4.1.2 PGP/MIME . 50 4.1.3 Research approaches . 50 4.1.4 Commercial approaches . 52 4.2 Technological approaches to trust . 53 4.2.1 Trust-Management-Based Technologies . 53 4.2.2 Automated trust negotiation .