Source
r/crypto•
petester

I'm taking my first crypto course, and I love it. How can I pursue an education or career in it?

I graduate next May with my BS in electrical engineering. All I need to meet my undergrad requirements, though, is to finish my senior design and take chemistry. So I started taking grad level courses and other random UG courses that look neat or whatever.

I love everything about my intro to crypto class which is in the CS department and at the grad level. I would love to take more classes on it, or even pursue it as a career if possible, but this is literally the only class on cryptography at my university. I asked the math department what other classes might be relevant, but I'm being told that our school is more 'applied' math, and they stopped teaching combinatorics classes a couple years ago due to lack of interest.

Is it still possible to get into a crypto related field even though I lack a focused education in it? What would be a roadmap into the industry for somebody like me?

Posted Sep 28, 2015, 2:51 AM UTC

2615
Octetz•

Crypto is usually connected with protocols, so work related to security protocols may be interesting. Note that you probably need a PhD to design crypto. (Not many companies design their own crypto)

8
0_0__-------____•

PhD to design crypto

Or just learn from an established cryptographer? If they're not willing, then I guess a PhD isn't a bad way to go. Some people are self-taught via the internet, but most people don't do well learning like that, I admit.

2
logophobia•

Or just learn from an established cryptographer? If they're not willing, then I guess a PhD isn't a bad way to go. Some people are self-taught via the internet, but most people don't do well learning like that, I admit.

The number one rule for (serious) crypto is, don't roll your own. Leave that to the professionals.

The amount of theory, known pitfalls and serious math you need to design a secure new protocol or algorithm (rather than just piping stuff over ssl) is rather large. Self taught learners might be able to do it, but I'd rather use something from someone with actual credentials for stuff that essential (like a phd, or at the very least a master's).

8
0_0__-------____•

Ummm, a PhD rolling his own is just as shady as a hobo doing it. If a corporation wants to take a massive risk, then sure have him give it a shot. But one dude fresh out of school with his PhD is not qualified to review his own algorithm.

Regardless, I wasn't talking about 'rolling your own'. I was talking about 'designing crypto'. Literally anyone can design crypto risk-free. If it sucks, the community of cryptographers won't give it the time of day or they'll ruin it. If they choose to use it in a production system without review I'll laugh; that's pretty funny.

1
pumphouse•

You can become a software developer who focuses in security. Crypto developer.

5
bblackshaw•

Yes, that's what I primarily do - working with SSL/TLS and SSH. Interesting work.

2
AgedAardvark•

I used to work with a guy that I think might have been a cryptodeveloper. He was little, hunched over, didn't talk much. Nobody was sure which project he was working on or who he reported to.

1
0_0__-------____•

Like two thirds of crypto these days is comp sci, the rest math. Comp sci is how I got into it.

5
ScottContini•

See link "So, You Want to Be a Cryptographer" -- https://www.schneier.com/crypto-gram/archives/1999/1015.html#SoYouWanttobeaCryptographer

Also, stay tuned here. In a couple weeks I will be posting something of similar nature.

4
refreshx2•

If you are interested in grad school, this is one of the good things about it. Grad school allows you to pivot, sometimes drastically (for example I know an english major who did math for grad school), and develop skills for your (new) interests without doing the undergrad stuff. You are expected to pick up on things 2-3x faster than undergrads do, but since you've done it already it isn't so bad. It might make sense for you to thinking about a masters or PhD if you also enjoy school. I'm in grad school now and engineering degrees often get paid. Working 40-60 hours a week on 20-30k might sound pretty awful, but I absolutely love it and 5 years of this won't be a problem. Everyone around me is smart so I deal with almost 0 BS and everyone is interesting. You also will love what you do and hopefully enjoy working on 80+% of your work. And you pretty much get to make your own schedule at my school, so if I want to take off Friday I just work really hard Mon-Thurs and as long as my stuff is done then it's no big deal. Long rant but maybe worth thinking about as a contrast to some of the comments I read below.

3
Neffelo•

I would start looking at industry certifications. Most jobs involving "Crypto" will generally be Information Assurance Engineering jobs. If you can get a security clearance, Defense contracting has a lot of jobs when it comes to that.

If you are specifically talking about the design of crypto systems, I don't know. There are a lot of systems engineering jobs that are about implementing security and cypto into system design and development.

2
prezvdi•

As a hiring manager always looking for good crypto developer skills, let me give you some specific advice. A good understanding of the underlying maths is important. As someone else mentioned, very few people on earth develop their own crypto algorithms, but many people must develop solutions using peer reviewed logic - AES, ECC (Chacha20, Brainpool, NIST, more . . .). Much work today is focused on the post-quantum world. How do we implement logic today to be safe in the threat model 20 years from now? Post-quantum asymmetric crypto is a very hot area. If you are going to go for a Phd, I would strongly recommend you consider some topic in that area. But I would also consider NOT going for a Phd - like most managers, I rate work (both paid and open source non-paid) experience much higher than I rate what you did in your Phd program. Frankly sometimes I don't even read what you did in your Phd program, I simply don't read past your last 2 jobs. Key words I look for on a CV: PKCS#4, PKCS#11, MS CAPI/NGC, KEK, JCE/JCA, specific ECC curves . . . . tell me what you DID with those API's to build a solution to a problem. The great CV's show a real depth of experience developing solutions with crypto, a solid understanding of the maths underlying crypto, a real-world understanding of the fragility of implementing crypto (think Sony - they did 99.999% of everything right in the PS/3 crypto implementation, but where burned with a side channel attack). Convince me you understand what IS a side channel attack when you implemented your last crypto solution. And finally, give great whiteboard. Stand up at the interview and make me believe you are the smartest guy in the room whiteboarding a crypto solution to a problem I toss out. Do all that and I'll hire you tomorrow. Do all that in 2 years and I promise you, someone will hire you then. Good luck. PM me if you want some specific advice.

2
lacosaes1•

Much work today is focused on the post-quantum world.

Some of the work is focused on post-quantum cryptography.

1
petesterOP•

Much work today is focused on the post-quantum world.

Could you explain that? Do you mean that people are currently trying to implement quantum-based crypto?

1
prezvdi•

Exactly this. Much of the cutting edge research/design work is around developing and deploying quantum resistant cryptographic algorithms. There is good news – most of the symmetric crypto used in banking applications (DUKPT, etc . . .) is unlikely to be effected by quantum computers. On the asymmetric front, there are two major areas of focus: hardening existing algorithms (RSA, ECDSA . . .) and newer algorithms including lattice and multivariate functions. In addition, a new concept of zero knowledge or best possible obfuscation may (key word: may) render the theoretical advances of quantum computers mute. Slightly old summary here: (http://www.nist.gov/customcf/get_pdf.cfm?pub_id=901595)

1