Security ceremonies : including humans in cryptographic protocols

Whether by using electronic banking, by using credit cards, or by synchronising a mobile telephone via Bluetooth to an in-car system, humans are a critical part in many cryptographic protocols daily. We reduced the gap that exists between the theory and the reality of the security of these cryptographic protocols involving humans, by creating tools and techniques for proofs and implementations of human-followable security. After three human research studies, we present a model for capturing human recognition; we provide a tool for generating values called Computer-HUman Recognisable Nonces (CHURNs); and we provide a model for capturing human perceptible freshness.

Ceremony analysis : strengths and weaknesses

We investigate known security flaws in the context of security ceremonies to gain an understanding of the ceremony analysis process. The term security ceremonies is used to describe a system of protocols and humans which interact for a specific purpose. Security ceremonies and ceremony analysis is an area of research in its infancy, and we explore the basic principles involved to better understand the issues involved.We analyse three ceremonies, HTTPS, EMV and Opera Mini, and use the information gained from the experience to establish a list of typical flaws in ceremonies. Finally, we use that list to analyse a protocol proven secure for human use. This leads to a realisation of the strengths and weaknesses of ceremony analysis.

Towards a secure human-and-computer mutual authentication protocol

We blend research from human-computer interface (HCI) design with computational based crypto- graphic provable security. We explore the notion of practice-oriented provable security (POPS), moving the focus to a higher level of abstraction (POPS+) for use in providing provable security for security ceremonies involving humans. In doing so we high- light some challenges and paradigm shifts required to achieve meaningful provable security for a protocol which includes a human. We move the focus of security ceremonies from being protocols in their context of use, to the protocols being cryptographic building blocks in a higher level protocol (the security cere- mony), which POPS can be applied to. In order to illustrate the need for our approach, we analyse both a protocol proven secure in theory, and a similar proto- col implemented by a �nancial institution, from both HCI and cryptographic perspectives.

Accolades or achievement? Addressing the unforeseen consequences of therapeutic pedagogy

Commentary "We have found little to indicate that indiscriminately promoting self-esteem in today’s children or adults, just for being themselves, offers society any compensatory benefits beyond the seductive pleasure it brings to those engaged in the exercise. (Baumeister, Campbell, Krueger, & Vohs, 2005)" In June this year, Wellesley High School became a focus of attention worldwide, following a graduation speech made by a teacher at the school. Departing from the traditional rhetoric of such ceremonies, English teacher David McCullough told the assembled graduates that they were neither special nor exceptional, but may well believe they were because they had been ‘pampered, cosseted, doted upon, helmeted, and bubble-wrapped, feted and fawned over’, an effect, he argued, of Americans’ ‘love of accolades more than genuine achievement’ (Christakis, 2012, p. 1). This assertion struck a chord not only in his home country, but more widely in the Western world, with many educators, childcare workers and parents experiencing a sense of unease about the extent to which this claim was justifiable, and if so, what sort of corrective might be needed.