PhD in Cryptography: Private Sector Career Advice

[Poopsilon]

So I'm getting to the point now where I need to start looking at graduate schools in mathematics. Being a pure math major my original plan has always been to get a phd in pure math and from there attempt to break into academia. But the more I learn about the current academic climate, the more clear it has become that my chances of becoming a tenured professor are slim to none no matter how hard I work or how prestigious of a school I attend.

Thus I've been considering my options for going into industry after my phd, and it seems that the best fit for me would probably be cryptography: it pays extremely well, it appears to use some very advanced number theory ( an area of mathematics I'm very interested in ), and it generally falls under the umbrella of the computer/software industry ( which would be my preferred area to work in ). What I really would like to avoid is getting a phd in math and then being hired for some job that uses almost no math just because of my 'critical thinking skills', and it seems like cryptography is one of the few jobs in the private sector which actually employs a mathematician AS a mathematician.

One of the things I'm trying to figure out is how much of this advanced pure math I will actually get to use, both in completing my phd and in industry. I enjoy both algebraic number theory as well as a lot of the hard analysis techniques found in analytic number theory, and for the practical reasons mentioned above I'm willing to direct these interests towards a phd in cryptography if they can still be part of my life upon applying for jobs in the private sector. I suppose I will also need to start teaching myself programming, which I am more than happy to begin doing lickidy split if I decide to begin going down this path, but I want to know approximately what I'm getting into so I can be relatively sure I won't be disappointed once its too late to change course.

For instance I found a book on Amazon which discusses applications of analytic number theory to cryptography, would employers even care that a potential cryptographer employee had this type of abstract knowledge? Cryptography is completely foreign territory to me beyond the very basics and I haven't been able to find many accessible resources, searching both on google and this forum, which describe the ins and outs of daily life for cryptographers ( with phd's) in the private sector. So maybe some of you could enlighten me or point me in the direction of some good resources on the subject.

 

[chiro]

The most obvious organization that stands out in your case is the NSA.

I know that they have internships for people who qualify who are asked to solve specific problems to do with security.

They also have training programs for qualified applicants where you get trained up and rotate through the various branches.

Of course even if you a sure candidate, the security clearance will be a nightmare and as a result you will have to wait a while for it to be cleared.

I guess if you like the environment and constraints you are put under (like being under strict confidentiality agreements and maintaining security of classified information), then it might be for you.

The big downside is that although you may get access to pretty amazing mathematics, you may not be able to tell anyone else with the exception of other NSA employees.

Maybe you should check out their website and see if it tickles your fancy.

 

[niehaoma]

I work in the area of cryptography, though I am NOT a cryptographer (I wish I had the mathematical background, but I do not). Your best bet is likely NSA/DoD. However, what area of cryptography are you interested in? Algorithm development, cryptanalysis, etc? This can help shape your path forward. I work in security compliance, and I can assure you in compliance there is not much room for innovation. For example, in my area, vendors are required to use known, vetted algorithms (NIST/FIPS 140-2 algo's, NSA algo's). However, perhaps for some companies, like RSA, there are opportunities to work on new problems. I believe an interesting area is that of Differential Power Analysis (as pioneered by Paul Kocher & team @ CRI) as a means to break algorithms, or more specifically, discover some or all of the cryptographic key utilized during the cryptographic operation. This work also involves, in both hardware and software, creating ways to minimize information leakage. One way this is done is to modify the cryptographic algorithm in HW/SW, without actually changing any of the mathematical properties of the algorithm. To me, this is complicated, interesting work.

I also agree with chiro, any classified work you work on will be hush hush. Again, I am not an expert, I work in the area of security compliance (FIPS, PCI, etc), but some of the resources in my field are folks from Cambridge (Ross Anderson and his students), Bruce Schneier, Asyemmtric algo's: RSA crypto, Elliptic curve crypto, and some symmetric algo's: TDES (Common in Financial Systems), AES (FIPS 197, also NSA Suite B adopted algo).

A simple search on Dice for "cryptography" results in about 112 matches. However, you will notice the new buzzword "Cyber Security". Be wary, most of the jobs will not utilize a strong mathematical background. Most, in fact, are glorified IT positions. My 2 cents.

 

[Poopsilon]

I have several misdemeanors and so would not be able to get a security clearance; which is unfortunate since if I had my druthers I would probably choose cryptanalysis with a government organization since a hobby of mine is learning to read foreign languages.

@niehaoma: I gave a quick look to differential power analysis on wikipedia and that does seem quite interesting, although I must say on the surface it appears like you with your masters in EE would be better suited for that than someone with an advanced degree in mathematics, but what do I know. I'm assuming cryptanalysis is probably done almost entirely by the government, so that would leave the creation and implementation of cryptographic algorithms side.

So what you're saying is that your job consists a lot in finding the best way to integrate known algorithms into your particular system? Do you generally find your work enjoyable and challenging? Are there people with masters/phds in math that work with you? and what do they do? Those people who are hired by private companies for their strong math backgrounds, are they employed to come up with novel algorithms for the company? Is there any room for cryptanalysis for them in the private sector?

@niehaoma & chiro: thanks for the advice so far, its been quite informative =].

 

[niehaoma]

In regards to SPA/DPA, it is multifaceted. Yes, there are elements of Software engineering/programming, Electrical Engineering, etc, however, if one is looking at a power trace, and attempting to hone in on an area of a signal, they must understand what they are trying to look for. In other words, there must be an association between the signal analysis and the mathematical algorithm implementation in order to extrapolate pertinent data. If you are interested, go visit CRI ( http://www.cryptography.com/ ). They should have published papers. Again, another aspect is attempting to modify the implementation of the algorithms in order to mask divulging information.

This is just one area. What I think is you need to find those small-niche private companies that needs your mathematical expertise. These companies can be off the primary search-engine road, and require diligence in finding them. If you explore cryptography, I am sure you will start building a set of resources that will help you.

I have worked with PhD's. Generally there are normally only a few, and they lend their expertise to the various individuals/teams as required. They might be working on their own, more advanced problems, possibly as a contracted out work effort. I have also worked with individuals who used a position in security compliance to fund their pursuit of a PhD, usually in mathematics.

In regards to my position, the word "compliance" is key. For security purposes, in the realm of cryptography, only vetted algorithms that have undergone a particular level of scrutiny are viable. These are generally NIST-approved algorithms. These algorithms are public, documented, and usually available in SW libraries (e.g. OpenSSL). However, as you may know, in this instance what is key (pun intended) is not the algorithm per se, but rather the management of the associated cryptographic key(s) utilized by the algorithm. As an analogy, what good is a safe if one leaves the key to it inserted, or on top of it. However, for cryptographic systems, this problem can be extremely complex, when one considers aspects of key generation (which includes sufficient entropy, length etc), key distribution, key establishment, key negotiation, key usage, tagging, expiration, revocation, so on and so forth.

Keep in mind I operate in one little section, so I am positive there are much more opportunities and areas of work that I am aware of, which you should explore.

 

[AVReidy]

Sounds like a job you should go for! You may as well get a PhD. I'm sure that won't make you any less fit for the cryptographer position.

On the other hand, if you believe you have all of the necessary pure math understanding for your desired job, then you're probably better off skipping the PhD and going right in.

Best of luck to you!

 

[JDGates]

Misdemeanors from several years before application will not, in general, result in a security clearance rejection.

If you're planning to keep committing them, on the other hand...

 

[elkement]

Hi Poopsilon,

and it seems like cryptography is one of the few jobs in the private sector which actually employs a mathematician AS a mathematician.

I am not a cryptographer, but I am working as an IT security consultant for companies that employ cryptographers. So I believe your assessment is correct.

I haven't been able to find many accessible resources, searching both on google and this forum, which describe the ins and outs of daily life for cryptographers ( with phd's) in the private sector. So maybe some of you could enlighten me or point me in the direction of some good resources on the subject.

My insights are from companies that develop products for secure authenication, mainly based on certificates (public key cryptography) - smart cards or USB tokens that serve as secure storage for the key material and that are equipped with an embedded OS that allows to run cryptographic algorithms.
Picking a random example of a typical product: http://www.safenet-inc.com/products...ion/certificate-based-pki-usb-authenticators/

In such companies math or computer science PhDs work in the R&D departments or product groups.
I cannot tell you exactly what the typical working day is like in terms of how many hours you would really work on algorithms. But these are definitely jobs that require mathematical skills - including the 'abstract' skills, number theory etc. Nevertheless you need to keep in mind that the final goal is a commercial product so even if your job title is Senior Cryptographer or the like you will also need to contribute to things like: Project management and controlling, presentations etc. You are part of a development team and you need to communicate with its less technical members such as product management. And you will need to follow deadlines, deliver on time and meet some requirements in addition to the technical specifications.

Since the goal is to implement algorithms in software you will be more concerned with the optimization of the algorithm and its implementation on a specific platform than with its pure mathematical representation. So I believe you should also be interested in the engineering part of cryptography to like this kind of work.

Of course the details depend a lot on the 'culture' of a company: Some companies foster a very 'geeky' lifestyle and let theirs nerds work on cool stuff most of the time. In other companies the administrative overhead in terms of reporting, forecasting etc. is very high and you cannot escape this - also as a technical specialist.

 

[Poopsilon]

Very informative post elkement, thanks. In regard to the cryptographers you work/have worked with who have phd's, I'm wondering if you know whether they did their dissertations specifically in algorithms/crypto or whether some come from pure math as well. I ask this because I would prefer to do a phd in pure math rather than applied, since pure math is where my interests primarily lie, and in order to keep my options open in academia.

Also could you maybe expand a bit on what you mean by the engineering parts of cryptography.

 

[elkement]

Hi again,

Very informative post elkement, thanks. In regard to the cryptographers you work/have worked with who have phd's, I'm wondering if you know whether they did their dissertations specifically in algorithms/crypto or whether some come from pure math as well. I ask this because I would prefer to do a phd in pure math rather than applied, since pure math is where my interests primarily lie, and in order to keep my options open in academia.

I do not know exactly what their theses were about unfortunately, but I am pretty sure that they had some sort of practical programming / implementation experience. So as long as you acquire some programming skills and can demonstrate those to a potential employer I would not worry too much about the main topic of the thesis.

Also could you maybe expand a bit on what you mean by the engineering parts of cryptography.

What I wanted to convey was the following: These jobs that I referred to are related to product development. There are very large companies that have R&D divisions that are very university-like, like Microsoft Research for example, but my experience is from companies / teams / researchers that really build rather down-to-earth products. These products do typically not require a break-through in cryptography (so I am not talking about developing quantum devices..), but rather need the skills to research state-of-the-art and put together existing pieces, test these very thoroughly to meet quality goals.

A former colleague of mine once told me that he thinks that aspriring developers in the security world consider cryptography to be more like 'fine arts' than engineering and craftswork - what he meant was that these developers rather design and develop a new protocol from scratch because this is so cool. But probably there is an existing standard / software library that could be re-used. That approach is probably more dull and less challenging but the ultimate goal - to deliver a new product on time - might be reached earlier.

So if you want to do really original work that type of cryptography job in industry might not be the right position for you.
I believe you need to be motivated by the goal to build a solution and ship it - you need a bit of an entrepreneural spirit to enjoy that work. If you start your own company (as a scientist or engineer) and build a product there are a lot of tasks to do that do not require a PhD in sciences - but you will and shoud like to work on those tasks as well because they are important to meet the goal which is to ship the product.

I was probably lucky as I already liked the 'engineering' approach a lot when I did my PhD - trying to find a solution most efficiently, like putting together devices that already existed in the lab. I found out later that this type of thinking also applied to more abstract concepts in software and cryptography - the way they are utilized in industry.

 

[DoggerDan]

One of the things I'm trying to figure out is how much of this advanced pure math I will actually get to use, both in completing my phd and in industry.

Have you asked these folks? http://www.nsa.gov/careers/