Alexander Krause is a PhD Candidate at CISPA - Helmholtz Center for Information Security and Leibniz University Hannover. He is a member of the TeamUSEC research group. His research interests include usable security and privacy as well as any surroundings in this research area. He received his MSc in Computer Science from Leibniz University Hannover in 2021 with distinction (1.0).
PhD in Computer Science, TBA ~2026
CISPA, Leibniz University Hannover
MSc in Computer Science, 2021
Leibniz University Hannover
BSc in Computer Engineering, 2019
Leibniz University Hannover
Responsibilities include:
Keeping cryptographic code up to date and free of vulnerabilities is critical for overall software security. Updating algorithms (e.g., SHA-1 to SHA-512), key sizes (e.g., 2048 to 4096 bits), protocols (e.g., TLS 1.2 to 1.3), or transitioning to post-quantum cryptography (PQC) are common objectives of cryptographic updates. However, previous work and recent incidents illustrate developers’ struggle with cryptographic updates. The research illustrates that many software products include outdated and insecure cryptographic code and libraries. However, the security community lacks a solid understanding of cryptographic updates. We conducted an interview study with 21 experienced software developers to address this research gap. We wanted to learn about their experiences, approaches, challenges, and needs. Our participants updated for security and non-security reasons and generally perceived cryptographic updates as challenging and tedious. They lacked structured processes and faced significant challenges, such as insufficient cryptographic knowledge, legacy support hindering cryptographic transition, and a lack of helpful guidance. Participants desired the assistance of cryptographic experts and understandable resources for successful updates. We conclude with recommendations for developers, academia, standards organizations, and the upcoming transition to PQC.