How to prepare for interviews? posted January 2015

If you are a student looking for an internship in Cryptography, that might be the right post for you.

Those past few months, before landing an internship at Cryptography Services, I applied in many places around the world and went through several interviews. Be it irl interviews, phone interviews, video interviews... I traveled to some remote places and even applied to companies I really did not want to work at. But those are important to get you the experience. You will be bad at your first interviews, and you don't want your first interviews to be the important ones.

In this post I'll talk about how I got interviews, how I prepared and dealt with them, how I got propositions. I might be wrong on some stuff but I'm sure this will help some students anyway :)

Think about them

Put yourself in the employer's shoes, he doesn't want to read a cover letter, he doesn't want to spend more than a few seconds on a resume, he doesn't want to hurt his eyes on horrific fonts, too many colors and typos.

Resume

• Ditch all those premade themes.
• Learn how to do something pretty with Word/LaTeX/Indesign/CSS...
• Okay, if you're really bad at building a nice layout, maybe you should use a premade theme, but then use a very simple/plain one.
• No more than one page (you're a student, don't be cocky).
• Use keywords.
• Be simple. Don't write something that belongs in the cover letter.

There is a lot of theory on C.V. making. I'm sure you can find better resources on how fabricate your resume.

Cover Letter

• Be concise (I use bullet points for my cover letters and it saves the reader time)
• Write well, make your friends read it, take a break and re-read it.
• Be formal, polite, etc...
• Don't hesitate to contact them again if they don't answer
• Use my application 3pages to write your cover letter (shameless plug :D)

Side Projects

Side projects are important, like really important. If you don't have anything to show you're just as good as the next student, (almost) no one will ask for your grades.

If you don't know what side project to work on, check Cryptopals (I'll be working with the folks who made this by the way :P)

Also if you're looking for something in development, applied crypto, get a github. Many employers will check for your github.

And, you know, you could... you could write a blog. That's a nice way to write down what you're learning, to motivate you into reading more about crypto and to be able to show what you're doing.

Where to apply?

Check with your professors, they usually know a list of known companies that do crypto. In France there are Thales, Morpho, Airbus and many big companies that you might want to avoid, and also very good companies/start-ups like Cryptoexpert, Quarkslab, ... that you should aim for.

You can also ping universities. They will usually accept you without an interview but will rarely pay you. If you really want to do academic researches, you should check some good universities in Finland, France, California, Sydney, India... wherever you want to go.

If you want to do crypto or applied crypto you might want to look for a start-up/smaller companies as they are not too big and you might learn more with them. But even in big companies you might find sizable crypto teams (rarely more than 2 or 3), check Rootlabs, Cloudflare, Matasano...

Preparation

Preparing for an interview is a really good opportunity to learn many things! If you know what the subject is about read more about it beforehand. If you don't know anything about the internship subject, read more about what your interviewers have done. If you don't know anything because you have been talking to a PR all along then you might want to rethink applying there.

Questions

In all the interviews I've done I just had one PR interview. I would advise you to refuse/avoid those, unless you really want to work for the company, as it's most always a waste of time /rant.

Most interviews in France were focusing on my side projects, whereas the ones I had in the US were way more technical. Younger and smaller companies did ask me things about me and my hobbies (one even asked me if I was doing some sport! I thought that was a neat question :))

Now, here's an unsorted list of questions I got asked:

• Explain whitebox cryptography
• How do you obfuscate a program?
• How can you tell a cipher is secure?
• How do stream ciphers work?
• What is a LFSR?
• name different stream/block ciphers
• Explain Simple Power Analysis
• Explain Differential Power Analysis
• Explain Differential Fault Analysis
• Any counter measures?
• Explain the Chinese Remainder Theorem
• How are points on an Elliptic Curve represented?
• What prevents me from signing a bad certificate?
• Imagine a system to send encrypted messages between two persons
• How to do it with Perfect Forward Secrecy?
• How does a compiler works?
• What is XSS?
• How could you get information on someone's gmail by sending him javascript in a mail?
• Explain Zero-knowledge with the discrete logarithm example
• You have a smartcard you can inject code on, what do you do to perform a DPA?
• You've recorded traces from the smartcard, do you have to do some precomputations on those traces before doing a DPA?
• Techniques to multiply points on an Elliptic Curve
• Example of homomorphic encryption
• Knapsack problem ...

Your questions

An interview should be an interaction. You can cheat your way through by trying not to talk too much, but it still should be a conversation because eventually, if you get the job, you guys will be having real work conversations.

You should be a nice dude. Because nobody wants to work with a boring, elitist dude.

You should never correct the interviewer. This feels like a stupid advice but correcting someone that knows more than you, even if you are right, might lead to bad things... Wait to be hired for that.

You should never let the interviewer tell you something you already know. This is an occasion for you to shine.

If you can't answer a question, ask the interviewer how he would have answer, this is a good opportunity to learn something.

Eventually, ask questions about the job, the workplace, the city. Not only they will appreciate it, it is showing that you are interested in their job, but it's also nice for you to see if the company is the kind of place you would like to work at (it also makes the table turns).

No bullshit

I don't know if any of you were planning on bullshiting but we're in a technical field, avoid bullshiting!