Cryptology Research for High School Student?

John3 asks: "My daughter is enrolled in an Advanced Science Research (ASR) course, at the local high school. The students join the program in 10th grade, choose a research topic, and then locate a mentor to work with them on their topic until high school graduation. My daughter took a cryptology course this past summer, and now she has chosen cryptology for her ASR topic. Most HS students pick mainstream research fields (medicine, genetics), so her science teacher is a bit unsure of where my daughter might locate a cryptology research project appropriate for advanced high school students (especially one that doesn't require security clearance). I'm hoping my fellow Slashdot readers might know of current cryptology/cryptography research projects that offered opportunities for a high school student to participate."

Comments

Math teachers!

[Jtoxification]

She needs to visit the math department of her local university.

Cryptography for fun and... more fun.

[Shazow]

Not exactly on topic of finding a mentor, but this request reminded me of my early Computer Science studies when my friends and I took turns coming up with encrypted strings, posted them on a newsgroup we frequented, and made it into a competition as to who could decrypt it first.

We started with simple stuff like letter substitution, ROT13, etcetera. And then moved on to masking and all sorts of fun/complicated algorithms. This was very educational, in the sense of learning about cryptography. We learned interesting concepts, and rapidly developed tools/scripts/methods for attempt to decrypt arbitrary strings.

Much fun.

- shazow

Replicate the MD5 Collision Stuff

[queenb**ch]

Why not have them replicate some existing work? That's usually a good way for folks to get a feel for what's going on. Since the MD5 collision source code got published recently, why not have them try to replicate that?

2 cents,

Queen B

This is hard

[Zork the Almighty]

It is extremely hard to suggest anything here unfortunately. Most mathematical research in this area requires a very strong background, and students generally just don't have the experience. The best thing you can do is point her at relatively new areas. Along those lines, I suggest quantum computing. Very few people "get" quantum computing right now, and its relatively easy to get started. From the description of the other course I gather she can program in some sort of language. Get her to simulate quantum computations on a regular computer - use a high level programming language. Then you can start investigating quantum algorithms. Start with simple algorithms like searching and sorting, and build up to quantum algorithms like Shor's algorithm for factoring integers. For the research component, have her try to devise a quantum algorithm for some sort of problem. Relatively few people have looked at this, so the field is wide open.

Re:This is hard

[emynems]

I would also strongly recommend her pursuing the quantum computing idea. When I was in high school (just a few years ago) I wrote a quantum computing algorithm that analyzed the effects quantum computing will have on hash functions. I also made modifications to a quantum simulator (written in C, run on a linux laptop) for a more "experimental" and tangible final project. I recommend starting out with a book: "A Shortcut Through Time: The Path to the Quantum Computer" (http://www.amazon.com/gp/product/B000AXRTYM/qid=1 136705266/sr=8-8/ref=pd_bbs_8/104-0428655-4663948? n=507846&s=books&v=glance) to think about which cryptology problems could be solved with a quantum computer.

Mentor

[Anonymous Coward]

There are plenty of jobs our there that deal with encryption that don't require a security clearence, or much math. Heck, Adobe was using ROT13 for parts of their drm in 2002...

The point is, lots of companies now use encryption in their products, and there is lots of interesting research to be examined about how products are using encryption (lots of products do it pretty bad, but a few do it really well). Go find a drm product, or vpn product, or any wifi developer and they will be doing something with crypto. Look at the work by the girl who optimized DES (? irrc, might have been aes) as her high school project.

That being said, if you think you've got a new encryption algorithm at that age, you will probably see it as an example problem in your crypto classes later on in life. Leave new algorithm to the .gov and .edu institutions that have hundreds of man-years of math research to build from.

not sure but there's a good summer program

[BoomTechnology]

http://www.mathismylife.org/ --CMST (center for math science and technology) has/had a really good summer program in classical cryptanalysis funded by the NSA and taught by employees of the NSA. I took it several summers ago -- very interesting. Very diverse age-group in it, but it was a very challenging course and provides a good base for entering the cryptology field -- they started off with basic mono-alphabetic shifts, and worked their way up to matrix-based algorithms and statistical analysis. At the end there's something crazy like a challenge with 23 different cryptograms that must be solved (that no one almost ever does)...something to look into, though this year it looks like they're having trouble finding a venue.

I don't mean to be insulting

[poopdeville]

I don't mean to be insulting, but there's no way she could comprehend anything for which she would require security clearances. OK, I suppose it's logically possible, but if she had the mathematics background necessary to it, she wouldn't need your advice for sources of information. Just take her to a university library and look for books in the field from the "Undergraduate Texts in Mathematics" (also called "UTM"s) by the Springer-Verlag publishing house. If she doesn't get that, she's in over her head.

Definitely possible

[avorpa]

I think I'm more qualified than most to answer this, since I in fact wrote my first published paper when I was in high school, and it was on cryptography. Most of cryptography is just maths, which is actually more accessible to beginners than other subjects since you don't special lab equipment. I'd say the best way to get into it is to think of a cryptographic problem you'd like to solve, and then just work on it. The problem that got me started was how to prove that you're a member of some group without revealing your identity. There are many different solutions, with different tradeoffs -- so even if a problem is supposedly solved there is often scope for new solutions.

For an idea of where cryptography research is going these days, she should read eprint.iacr.org. A lot of those papers are pretty technical and heavy going, but it will at least give some starting points.

The biggest problem I'd see is not finding a feasible problem, but finding a teacher capable of marking it. I know none of my high school teachers could have marked my cryptography research.

Some ideas

[swillden]

Before you can answer that question, you have to figure out what is meant by "research". There's fairly little in the area that professional cryptographers consider to be research that would be accessible to even a very precocious high school student.

However, it's doubtful that the intention of this project is actually to advance the state of humanity's cryptographic knowledge. Realistically, the goals is to find a challenging and educational project for the student, and something that is not obvious to most non-cryptographers.

Given appropriate expectations, I think there are lots of things a fairly sophisticated high school student could do that would be worthwhile, particularly if you want to look beyond cipher design. Some of the areas that might be interesting include:

• Cryptanalysis. Attacking full-blown, real ciphers is not a good place to start, but breaking some reduced-round variants, old, already-broken ciphers, or just researching cryptanalytic techniques could be an excellent project.
• Protocol design. Much more real-world work is done in this area than on ciphers. Ciphers are really just building blocks, to do something useful you need to build a protocol. Pick a real-world problem, choose an appropriate set of tools (ciphers, hash functions, hardware, etc.) and then design a protocol that solves the problem. Then analyze the protocol, try to identify any weaknesses (it's helpful to study on typical attack routes; some of them are very non-obvious) and then try to fix the weaknesses. By way of example, one problem I used in some classes I taught a few years ago was that of an electronic purse. Given a smart card that can store data, perform calculation, perform 3DES en/decryption and perform SHA-1 hashes, design a secure electronic purse. There are three parties involved, the cardholder, the merchant and the bank (who issues the card and loads the value). Define all of the messages between all of the entities and card and assure that no party can defraud any other.
• Protocol analysis. Take a real-world crypto protocol, like, say SSL, and analyze it with respect to various attacks. Explain how and why it resists each attack (or not!).
• Key management. Assume some real-world problem with already-defined protocols and try to come up with a way for the involved parties to distribute/manage/agree upon keys. Then attack it from various perspectives, including that of an insider. Try to strengthen it so that even an insider with full access to the system can't subvert the system.
• Cipher/protocol implementation. Assuming the student is a capable programmer, an interesting challenge is to implement a cipher or (simple) protocol, then try to prove that the implementation is correct and does not leak information.
• Attack implementation. Take a known attack, such as the recently-published MD-5 collision attacks, the RSA attacks that prompted the development of OAEP, an attack on some reduced-round cipher variant, the SSL man-in-the-middle attack, WEP cracking, etc. -- there are thousands of options -- and try to implement it. Note that many of the attacks require a great deal of statistics, and are probably beyond most gifted high school students, but there are plenty that are accessible (though this also requires programming skills).

Never underestimate the power of a high schooler

[miforbes]

I went to a Magnet high school (http://mbhs.edu/departments/magnet/) (a public school that takes in the top 100 students from the county to teach them an advanced curriculum) and part of the requirements for earning a Magnet diploma was to do a Senior Research Project (SRP) that sounds very much like ASR. To find a mentor (I wanted to do theoretical computer science, I had done some independent research on graph theory in my own time) I emailed a professor at the University of Maryland and worked over my 11th grade summer with him. I came up with a result, not important enough to get published, but it won me this award: http://www.sciserv.org/sts/64sts/Forbes.asp and got me into MIT.

For advanced topics such as cryptography the best bet is the local university. There are also a bunch of government facilities out there that do research. Some of the best places (mostly in the DC area, however) are the NSA (http://www.nsa.gov/careers/students_1.cfm) and NIST (http://csrc.nist.gov/) (NIST can offer housing, btw). There is also a great program for high school juniors at MIT or Caltech (no cost): http://www.cee.org/rsi/index.shtml .

Just to show that high-school cryptography research is possible: http://www.sciserv.org/sts/60sts/Dunn.asp . This guy is the older brother of one of my friends (both who went to the same high school program as I) and I believe he did his research at NIST.

-Michael Forbes

Two essays, and a pointer

[woefulhc]

Just thought I'd toss in my few cents.

Bruce Schneier has a couple of essays that you might want to have your daughter check out. (Hopefully she already knows the info in the first, but....)

Here is his imput on how to get into the crypto field.

Why is crypto so hard .

If you or she aren't so keen on working with a local college/university math/CS department, I second the advice to hit up Phil Zimmermann. His site lists a number of ways to contact him. It also talks about his current project. (I found Mr. Zimmermann to be very gracious. I think the worst he would do is say no. More likely he would either agree or suggest someone as a alternative.)