Cryptology Research for High School Student?

John3 asks: "My daughter is enrolled in an Advanced Science Research (ASR) course, at the local high school. The students join the program in 10th grade, choose a research topic, and then locate a mentor to work with them on their topic until high school graduation. My daughter took a cryptology course this past summer, and now she has chosen cryptology for her ASR topic. Most HS students pick mainstream research fields (medicine, genetics), so her science teacher is a bit unsure of where my daughter might locate a cryptology research project appropriate for advanced high school students (especially one that doesn't require security clearance). I'm hoping my fellow Slashdot readers might know of current cryptology/cryptography research projects that offered opportunities for a high school student to participate."

Comments

Math teachers!

[Jtoxification]

She needs to visit the math department of her local university.

Replicate the MD5 Collision Stuff

[queenb**ch]

Why not have them replicate some existing work? That's usually a good way for folks to get a feel for what's going on. Since the MD5 collision source code got published recently, why not have them try to replicate that?

2 cents,

Queen B

not sure but there's a good summer program

[BoomTechnology]

http://www.mathismylife.org/ --CMST (center for math science and technology) has/had a really good summer program in classical cryptanalysis funded by the NSA and taught by employees of the NSA. I took it several summers ago -- very interesting. Very diverse age-group in it, but it was a very challenging course and provides a good base for entering the cryptology field -- they started off with basic mono-alphabetic shifts, and worked their way up to matrix-based algorithms and statistical analysis. At the end there's something crazy like a challenge with 23 different cryptograms that must be solved (that no one almost ever does)...something to look into, though this year it looks like they're having trouble finding a venue.

Some ideas

[swillden]

Before you can answer that question, you have to figure out what is meant by "research". There's fairly little in the area that professional cryptographers consider to be research that would be accessible to even a very precocious high school student.

However, it's doubtful that the intention of this project is actually to advance the state of humanity's cryptographic knowledge. Realistically, the goals is to find a challenging and educational project for the student, and something that is not obvious to most non-cryptographers.

Given appropriate expectations, I think there are lots of things a fairly sophisticated high school student could do that would be worthwhile, particularly if you want to look beyond cipher design. Some of the areas that might be interesting include:

• Cryptanalysis. Attacking full-blown, real ciphers is not a good place to start, but breaking some reduced-round variants, old, already-broken ciphers, or just researching cryptanalytic techniques could be an excellent project.
• Protocol design. Much more real-world work is done in this area than on ciphers. Ciphers are really just building blocks, to do something useful you need to build a protocol. Pick a real-world problem, choose an appropriate set of tools (ciphers, hash functions, hardware, etc.) and then design a protocol that solves the problem. Then analyze the protocol, try to identify any weaknesses (it's helpful to study on typical attack routes; some of them are very non-obvious) and then try to fix the weaknesses. By way of example, one problem I used in some classes I taught a few years ago was that of an electronic purse. Given a smart card that can store data, perform calculation, perform 3DES en/decryption and perform SHA-1 hashes, design a secure electronic purse. There are three parties involved, the cardholder, the merchant and the bank (who issues the card and loads the value). Define all of the messages between all of the entities and card and assure that no party can defraud any other.
• Protocol analysis. Take a real-world crypto protocol, like, say SSL, and analyze it with respect to various attacks. Explain how and why it resists each attack (or not!).
• Key management. Assume some real-world problem with already-defined protocols and try to come up with a way for the involved parties to distribute/manage/agree upon keys. Then attack it from various perspectives, including that of an insider. Try to strengthen it so that even an insider with full access to the system can't subvert the system.
• Cipher/protocol implementation. Assuming the student is a capable programmer, an interesting challenge is to implement a cipher or (simple) protocol, then try to prove that the implementation is correct and does not leak information.
• Attack implementation. Take a known attack, such as the recently-published MD-5 collision attacks, the RSA attacks that prompted the development of OAEP, an attack on some reduced-round cipher variant, the SSL man-in-the-middle attack, WEP cracking, etc. -- there are thousands of options -- and try to implement it. Note that many of the attacks require a great deal of statistics, and are probably beyond most gifted high school students, but there are plenty that are accessible (though this also requires programming skills).

Two essays, and a pointer

[woefulhc]

Just thought I'd toss in my few cents.

Bruce Schneier has a couple of essays that you might want to have your daughter check out. (Hopefully she already knows the info in the first, but....)

Here is his imput on how to get into the crypto field.

Why is crypto so hard .

If you or she aren't so keen on working with a local college/university math/CS department, I second the advice to hit up Phil Zimmermann. His site lists a number of ways to contact him. It also talks about his current project. (I found Mr. Zimmermann to be very gracious. I think the worst he would do is say no. More likely he would either agree or suggest someone as a alternative.)