Cryptology Research for High School Student?

John3 asks: "My daughter is enrolled in an Advanced Science Research (ASR) course, at the local high school. The students join the program in 10th grade, choose a research topic, and then locate a mentor to work with them on their topic until high school graduation. My daughter took a cryptology course this past summer, and now she has chosen cryptology for her ASR topic. Most HS students pick mainstream research fields (medicine, genetics), so her science teacher is a bit unsure of where my daughter might locate a cryptology research project appropriate for advanced high school students (especially one that doesn't require security clearance). I'm hoping my fellow Slashdot readers might know of current cryptology/cryptography research projects that offered opportunities for a high school student to participate."

Comments

Math teachers!

[Jtoxification]

She needs to visit the math department of her local university.

Some ideas

[swillden]

Before you can answer that question, you have to figure out what is meant by "research". There's fairly little in the area that professional cryptographers consider to be research that would be accessible to even a very precocious high school student.

However, it's doubtful that the intention of this project is actually to advance the state of humanity's cryptographic knowledge. Realistically, the goals is to find a challenging and educational project for the student, and something that is not obvious to most non-cryptographers.

Given appropriate expectations, I think there are lots of things a fairly sophisticated high school student could do that would be worthwhile, particularly if you want to look beyond cipher design. Some of the areas that might be interesting include:

• Cryptanalysis. Attacking full-blown, real ciphers is not a good place to start, but breaking some reduced-round variants, old, already-broken ciphers, or just researching cryptanalytic techniques could be an excellent project.
• Protocol design. Much more real-world work is done in this area than on ciphers. Ciphers are really just building blocks, to do something useful you need to build a protocol. Pick a real-world problem, choose an appropriate set of tools (ciphers, hash functions, hardware, etc.) and then design a protocol that solves the problem. Then analyze the protocol, try to identify any weaknesses (it's helpful to study on typical attack routes; some of them are very non-obvious) and then try to fix the weaknesses. By way of example, one problem I used in some classes I taught a few years ago was that of an electronic purse. Given a smart card that can store data, perform calculation, perform 3DES en/decryption and perform SHA-1 hashes, design a secure electronic purse. There are three parties involved, the cardholder, the merchant and the bank (who issues the card and loads the value). Define all of the messages between all of the entities and card and assure that no party can defraud any other.
• Protocol analysis. Take a real-world crypto protocol, like, say SSL, and analyze it with respect to various attacks. Explain how and why it resists each attack (or not!).
• Key management. Assume some real-world problem with already-defined protocols and try to come up with a way for the involved parties to distribute/manage/agree upon keys. Then attack it from various perspectives, including that of an insider. Try to strengthen it so that even an insider with full access to the system can't subvert the system.
• Cipher/protocol implementation. Assuming the student is a capable programmer, an interesting challenge is to implement a cipher or (simple) protocol, then try to prove that the implementation is correct and does not leak information.
• Attack implementation. Take a known attack, such as the recently-published MD-5 collision attacks, the RSA attacks that prompted the development of OAEP, an attack on some reduced-round cipher variant, the SSL man-in-the-middle attack, WEP cracking, etc. -- there are thousands of options -- and try to implement it. Note that many of the attacks require a great deal of statistics, and are probably beyond most gifted high school students, but there are plenty that are accessible (though this also requires programming skills).