Cryptology Research for High School Student?

John3 asks: "My daughter is enrolled in an Advanced Science Research (ASR) course, at the local high school. The students join the program in 10th grade, choose a research topic, and then locate a mentor to work with them on their topic until high school graduation. My daughter took a cryptology course this past summer, and now she has chosen cryptology for her ASR topic. Most HS students pick mainstream research fields (medicine, genetics), so her science teacher is a bit unsure of where my daughter might locate a cryptology research project appropriate for advanced high school students (especially one that doesn't require security clearance). I'm hoping my fellow Slashdot readers might know of current cryptology/cryptography research projects that offered opportunities for a high school student to participate."

Comments

Math teachers!

[Jtoxification]

She needs to visit the math department of her local university.

Speaking as an HS student who's done CS research

[Anonymous Coward]

Just give her access to all the texts and digital paper libraries she may need. After a while, she'll naturally acrue enough knowledge to start interacting with profs in the field and have interesting ideas.

The key point is for her to clock in the background knowledge by spending time each day learning more. However, it needs to be self motivated with no outside pressure, else it won't be a fun and trully motivated effort.

I don't mean to be insulting

[poopdeville]

I don't mean to be insulting, but there's no way she could comprehend anything for which she would require security clearances. OK, I suppose it's logically possible, but if she had the mathematics background necessary to it, she wouldn't need your advice for sources of information. Just take her to a university library and look for books in the field from the "Undergraduate Texts in Mathematics" (also called "UTM"s) by the Springer-Verlag publishing house. If she doesn't get that, she's in over her head.

Definitely possible

[avorpa]

I think I'm more qualified than most to answer this, since I in fact wrote my first published paper when I was in high school, and it was on cryptography. Most of cryptography is just maths, which is actually more accessible to beginners than other subjects since you don't special lab equipment. I'd say the best way to get into it is to think of a cryptographic problem you'd like to solve, and then just work on it. The problem that got me started was how to prove that you're a member of some group without revealing your identity. There are many different solutions, with different tradeoffs -- so even if a problem is supposedly solved there is often scope for new solutions.

For an idea of where cryptography research is going these days, she should read eprint.iacr.org. A lot of those papers are pretty technical and heavy going, but it will at least give some starting points.

The biggest problem I'd see is not finding a feasible problem, but finding a teacher capable of marking it. I know none of my high school teachers could have marked my cryptography research.

Some ideas

[swillden]

Before you can answer that question, you have to figure out what is meant by "research". There's fairly little in the area that professional cryptographers consider to be research that would be accessible to even a very precocious high school student.

However, it's doubtful that the intention of this project is actually to advance the state of humanity's cryptographic knowledge. Realistically, the goals is to find a challenging and educational project for the student, and something that is not obvious to most non-cryptographers.

Given appropriate expectations, I think there are lots of things a fairly sophisticated high school student could do that would be worthwhile, particularly if you want to look beyond cipher design. Some of the areas that might be interesting include:

• Cryptanalysis. Attacking full-blown, real ciphers is not a good place to start, but breaking some reduced-round variants, old, already-broken ciphers, or just researching cryptanalytic techniques could be an excellent project.
• Protocol design. Much more real-world work is done in this area than on ciphers. Ciphers are really just building blocks, to do something useful you need to build a protocol. Pick a real-world problem, choose an appropriate set of tools (ciphers, hash functions, hardware, etc.) and then design a protocol that solves the problem. Then analyze the protocol, try to identify any weaknesses (it's helpful to study on typical attack routes; some of them are very non-obvious) and then try to fix the weaknesses. By way of example, one problem I used in some classes I taught a few years ago was that of an electronic purse. Given a smart card that can store data, perform calculation, perform 3DES en/decryption and perform SHA-1 hashes, design a secure electronic purse. There are three parties involved, the cardholder, the merchant and the bank (who issues the card and loads the value). Define all of the messages between all of the entities and card and assure that no party can defraud any other.
• Protocol analysis. Take a real-world crypto protocol, like, say SSL, and analyze it with respect to various attacks. Explain how and why it resists each attack (or not!).
• Key management. Assume some real-world problem with already-defined protocols and try to come up with a way for the involved parties to distribute/manage/agree upon keys. Then attack it from various perspectives, including that of an insider. Try to strengthen it so that even an insider with full access to the system can't subvert the system.
• Cipher/protocol implementation. Assuming the student is a capable programmer, an interesting challenge is to implement a cipher or (simple) protocol, then try to prove that the implementation is correct and does not leak information.
• Attack implementation. Take a known attack, such as the recently-published MD-5 collision attacks, the RSA attacks that prompted the development of OAEP, an attack on some reduced-round cipher variant, the SSL man-in-the-middle attack, WEP cracking, etc. -- there are thousands of options -- and try to implement it. Note that many of the attacks require a great deal of statistics, and are probably beyond most gifted high school students, but there are plenty that are accessible (though this also requires programming skills).

Never underestimate the power of a high schooler

[miforbes]

I went to a Magnet high school (http://mbhs.edu/departments/magnet/) (a public school that takes in the top 100 students from the county to teach them an advanced curriculum) and part of the requirements for earning a Magnet diploma was to do a Senior Research Project (SRP) that sounds very much like ASR. To find a mentor (I wanted to do theoretical computer science, I had done some independent research on graph theory in my own time) I emailed a professor at the University of Maryland and worked over my 11th grade summer with him. I came up with a result, not important enough to get published, but it won me this award: http://www.sciserv.org/sts/64sts/Forbes.asp and got me into MIT.

For advanced topics such as cryptography the best bet is the local university. There are also a bunch of government facilities out there that do research. Some of the best places (mostly in the DC area, however) are the NSA (http://www.nsa.gov/careers/students_1.cfm) and NIST (http://csrc.nist.gov/) (NIST can offer housing, btw). There is also a great program for high school juniors at MIT or Caltech (no cost): http://www.cee.org/rsi/index.shtml .

Just to show that high-school cryptography research is possible: http://www.sciserv.org/sts/60sts/Dunn.asp . This guy is the older brother of one of my friends (both who went to the same high school program as I) and I believe he did his research at NIST.

-Michael Forbes