Please read the following before sending me email asking me to be your
Supervisor. The volume of email
that I get makes it impossible to respond personally to all inquiries.
I am most likely to respond to inquiries from potential students
already in Canada, or who can provide references from colleagues that I
regularly interact with (e.g., I know many researchers in the U.S. and Europe).
If you send me an email asking me to be your Supervisor (and fund
you) before reading this page,
my first impression will be that you are not seriously interested.
Taking a few minutes to
explore information available on my web site, directed specifically to
you, provides an indication that you have some basic research skills.
"Will you be my (Master's, PhD) supervisor or post-doctoral host?" and
I supervise students interested in research addressing
practical aspects of computer and Internet security, typically at the
graduate level (sometimes undergraduate students distinguish themselves).
For potential graduate students,
I have a strong first preference for
domestic Canadians or permanent residents (landed immigrants),
whom I am particularly interested in for the very pragmatic reason that
this makes you eligible for major Canadian scholarships.
If you are a foreign student, holding equivalent foreign scholarships is
equally valid as an important academic distinction, to provide
concrete evidence of a combination of past achievement and discipline.
Due to my inability to otherwise differentiate the many candidates I've
never met in person,
another coarse filter is a natural preference for students with an A grade average.
Ideally, your background (aside from an interest in
computer security) includes several of:
data networks and protocols,
human-computer interaction (to support usable security research).
Before asking me to be your Supervisor or for a letter of reference,
please read the following typical questions I get, and act accordingly.
Q1: Can you write me a letter of reference? (I am a student)
If I am personally familiar with your work,
I will be happy to try to accommodate your request.
I can usually do this within two weeks of receiving the
information listed below.
If you require more than one letter, I will write a generic
"To Whom It May Concern" letter. Please provide me details on:
Q2: Will you be my Master's or Ph.D. supervisor?
- the position or scholarship you are seeking;
- the recipient's contact details as you would like them to
appear on the letter header; and
- a hard copy of any instructions or forms to be filled out
(highlight any criteria which those receiving the letter
expect it to address).
I will also need:
- up-to-date copies of your transcripts (undergraduate and graduate); and
- your cv or resume including all degrees, publications and experience
(highlight your experience in software security and applied cryptography).
My objective is to take on the very best students,
and to do excellent work with them;
there are few things that make academic life more rewarding.
While my first priority is to my existing graduate students,
and there are only a fixed number of hours in every day,
I would like to believe that I always have room to take on
additional exceptional students.
However, there are many issues to consider, as discussed under two cases below.
(Of course, if I have never met you, you are from a foreign country,
and we have no common acquaintances, Q2 is a strange question
to ask by email---e.g., how would I verify the integrity of any claims
made by you or any of your references? As a prospective security
student, you should appreciate the irony of such a request.)
Case 1: You are applying for a Master's degree (or are already in our
program at Carleton).
Please note that whether you qualify for admission to the university,
for either a Master's or a Ph.D. program,
is not decided upon by individual professors. Rather, that is decided
by other university administrators, after you have prepared and
submitted a formal application package. Any formal offer of admission
will come from the university, not from individual professors.
If you are:
(a) a truly exceptional student - e.g. are or expect to be a
graduate scholarship holder (e.g. NSERC), or an A student with
recommendations from someone whom I know or trust; or
(b) have excellent industrial experience in security,
in the past have been a strong student (e.g., overall A),
and have strong recommendations from people whom I know or trust,
then please send mail
including subject line ("inquiry from exceptional student"),
briefly summarizing your tangible accomplishments,
including grade average or GPA, and where your degrees are from.
Otherwise, I advise that you gain admission based on your good academic record.
In your first 4-8 months in the program, distinguish yourself through your
coursework, and acquire a solid background in security, including
attendance at security seminars and talks.
After this time, update me on your progess and continuing interest;
we will then have a basis for discussion.
Case 2: You are interested in pursuing a Ph.D.
In addition to admission by the university (see above),
a faculty member must agree to be your supervisor before you will be
admitted to Carleton's Computer Science Ph.D. program. To help me make
such a long-term commitment (e.g. 3 to 5 years), please provide all of
the following information.
It is impossible for me to have any confidence that there will be
a good working relationship without having met you,
heard you present (e.g. at a conference),
or seen some of your work (e.g. in a course, a report or research paper).
I typically take on a PhD student only after gaining a high
degree of confidence that they will succeed, e.g.
requiring that they distinguish themselves through course work
(ideally taking a course with me as a Master's student), or someone I trust
recommends them highly.
Reference letters from people whose names I do not recognize
and/or whom I do not know personally are of limited value.
(background) Indicate your grade average; where your degrees are from;
who you have worked with; what your publication record is; and what your
background is in information security
(if none, why you think you will succeed nonetheless).
I generally expect that before entering a Ph.D. program under my
supervision, you will already have significant practical or academic
background in security (in order to be sure that you really want to
commit 3-5 years of your life to studying this area).
(determination of common research interests)
Select one of my recent papers which you find interesting and tell me why,
along with any insightful comments, or suggestions for extending the research.
(funding) Of the many possible funding arrangements, tell me your plans
(e.g. top Canadian students distinguish themselves through securing
NSERC or OGS scholarships; top foreign students often bring scholarships with them).
In Canada, you often must apply for major scholarships 6-12 months
in advance of a September start date.
If you have not distinguished yourself as a scholarship holder,
tell me why you believe you have the potential to succeed as a Ph.D. student.
Q3: Can you host me for post-doctoral research in the area of security?
I would be delighted, if there is a good fit. I assume that we have previously met at a conference
or elsewhere (or that I know your current supervisor sufficiently well to
trust their recommendation),
that your research is in an area in which I am active, and
that you will either be bringing with you some base funding
(e.g. NSERC post-doctoral scholarship), or will be interested in
participating in project research to help fund your stay.
Tell me what types of research you do, how it complements my own or that of
our group, and what your funding arrangements or needs are.
If we have never met and I don't know anyone that you have been working with,
then I usually can't do more than wish you luck
(to get things started, I almost always need a recommendation
from someone whom I know, or know of).
If you are a post-doctoral candidate, but your research to date has not
involved computer and Internet security, then you are not likely a good
fit, as I prefer post-docs capable of mentoring my graduate students
and contributing directly to my own research.
Q4: What overall costs (international tuition fees, living expenses,
etc.) should I plan for?
For graduate degrees in Carleton University's School of Computer Science (SCS),
international PhD students with very strong marks may be offered
admission with reduced tuition fees (equivalent to Canadian domestic tuition).
To estimate domestic or international tuition and other living expenses, see the estimator tool at:
and Fees (for International Students).
The tool estimates tuition for a 4-month term,
and thus should be adjusted for three such terms per year
(SCS grad students typically must enroll year-round to do their research);
for example, the tool indicates that as of Sept 2019,
international tuition for a graduate Computer
Science student exceeds ($Cdn) 7,000-8,000 per four-month term,
with a Master's degree typically 5-6 terms (e.g, 2 years), and
a PhD 3-4 years or more.
Q5: I am currently a Carleton student and
need help with [writing style, English grammar, etc.].
I would like to be your graduate student but I find
English to be challenging - is this important?
A: I recommend you start by consulting a suitable
Writing Tutorial Service (at many universities, such a service is
free to enrolled students) and explore any available courses on
communications skills for science or engineering students.
I believe extreme clarity and precision
in both written and verbal communications is required in order to
be a successful computer security researcher.
Q6: Cryptography is my passion. My life's dream is to
study this subject under your guidance. I will work day and night to
please you. Is this possible?
Not with me.
For over 15 years now, my research has been in computer and Internet
security---and for this, strong background in applied
cryptography is indeed helpful, but cryptography is no longer my research focus.
Your question is a signal that you have not taken
the time to do background review for something for
which you are about to dedicate
2-5 years of your life (for a Master's and PhD, respectively).
I suggest that spending a bit more time reviewing the research interests,
and publications pages of potential supervisors,
would help make a more convincing case that you are serious.
Similarly, if you ask whether I can supervise you for an engineering
degree---for that you would have to enroll in an engineering department,
in which case I may be allowed to co-supervise.
............. Last updated: 19 Sept 2019