The conference I'm at, CCS 2009, is scheduled to wrap up a little later today. It's been a great conference so far, and I've fully enjoyed attending it. But it occurred to me that this is the fifth major computer-security conference I've attended, and that there are some big differences between them. As a service to students and young researchers, therefore, I'd like to present a very personal and biased overview and comparison of major security conferences so that readers can decide which ones are the best uses of their travel budgets.
CCS
Since I am at CCS, I might as well start here. This is the big ACM conference on computer security, and it shows. It's in a big hotel, attendance is in the multiple hundreds, and the banquet was held on a cruise ship sailing around Lake Michigan.
In terms of technical content, I am very impressed with the balancing act this conference manages to pull off. The papers nicely present a wide variety of technical areas, from voting systems to cryptographic protocols to malware to securing MMOPGs. (There does seem to be a emphasis on anonymization networks like Tor, but apparently the emphasis shifts from topic to topic each year.) There is also a nice balance between theory and practice in the papers presented, meaning both that they hit the right balance on average and that there is a nice spread along that spectrum. Lastly, there is a nice balance in the attendee population between students, professors, industrial researchers, and government researchers. All in all, I would say that this (and Oakland, below) serve as the standard reference model for a security conference. If you are interested in a variety of topics and want to get a sense of the field's current research trends, you won't go wrong by coming here.
The only complaint I have is that the conference has multiple sessions, meaning that there are multiple talks happening at the same time. On the one hand, it means that they can accept a lot of good papers. On the other hand, I have more than once wanted to be at both talks simultaneously.
[IEEE Symposium on Security and Privacy](http://www.ieee-security.org/TC
/SP-Index.html)
The first important thing to know about this conference is that its name is officially pronounced "Oakland" (/ˈoʊklənd/). The reason for this is that unlike CCS, which moves from city to city, this conference is always held at the Claremont Resort in Oakland, California. Just as CCS is the ACM's flagship conference for computer security, this is the flagship security conference for the IEEE. You again find a nice variety of topics, a nice balance of theory and practice, and a nice mix of attendees. I've heard some people characterize this conference as more applied and practical than CCS. I think that compared to the other conferences in this survey, however, the difference between Oakland and CCS is so fine as to be negligible. Both conferences are very high quality, and you should be proud to get a paper into either. Likewise, a student seeking to ascertain the current 'hot' research areas would be well-served by either one of these events.
One advantage that this conference has over CCS is that there is a single 'track,' and so an attendee really can see all the presentations. Also it has a session for short (5-minute) talks, which is a great venue for hearing about research in progress, upcoming conferences and workshops, funding agencies describing work they'd like to fund, etc. etc. etc. The downside to this conference, especially if you are a speaker, is that the audience heckles. You remember Statler and Waldorf from The Muppet Show? Okay, it's not that bad. But there does seem to be this solid line of crotchety old men in the back row who remember all the computer-security research from the 70's and 80's and voice their irritation that you didn't cite their paper on roughly the same topic from thirty years ago. True story: I once happened to stumble upon a broadcast of the UK's Questions to the Prime Minister, wherein the Prime Minister gets noisily booed by the opposition (example). My first thought? "That's just like Oakland!"
You remember what I said, above, about balance? Well, forget it. This conference knows what it likes, and what it likes is theoretical crypto, baby!
Like Oakland, this conference is held at the same place each year: University of California, Santa Barbara. The accommodation, being dorm rooms, are a little more spartan than the Claremont Resort and the food isn't nearly as good. But this conference is the top venue in the world for current research in complexity-based cryptography. You can think of this conference as where cryptography comes from. If you want to know how to make crypto, come here. If you want to talk about how it is used, on the other hand, look elsewhere. There is the occasional talk about recent attacks on real-world crypto, but really, such talks are just an amuse-bouche for the main dish: new results in the a particular sub-field of complexity theory (AKA 'crypto').
To enjoy this conference, you really have to be interested in cryptography as an exercise in advanced mathematics. Most of the cryptographic schemes described here are impractical to the verge of ludicrousness. But that's not the point-- they prove that something is mathematically possible or true, and that's what really matters to this audience. If you're in to that kind of thing, this conference is heaven. (And even more heavenly is a recent spin- off, the TCC.) But if you think that implementations or standard matter, for example, then this conference can seem a little pie-in-the-sky.
Also, and this may be even more subjective than the rest of the post, CRYPTO can seem a little clique-y. Most of the more senior attendees have been coming here for decades, and they know each other really well. And most of the other attendees will be their students, or their students' students, or so on. Given that everyone knows, is a colleague of, or a co-author with everyone else, it can seem a little impenetrable to outsiders.
CSF
This one is both my favorite conference, and the conference on this list I have attended the most. I'm not sure which way causality goes there. In either case, the Computer Security Foundations Symposium (previously the Computer Security Foundations Workshop) is a much smaller venue than any other conference on this list: about 100 people. And this is still larger than it used to be. Back when it was a workshop, it was open to participants only (authors & committee-members). It also tends to be more isolated then the other conferences-- though it moves to a new location every year or two, it tends to choose remote venues which it can have all to itself. (Small hotels, university-owned retreats, etc.) This isolation, and the fact that the same people keep coming back year after year, has led to a very collegial, intense, and immersive environment. People come here to see top-notch work, and because just about every random conversation over dinner will inspire a collaboration which leads to further top-notch work. If you are a researcher, this is the workshop you've always dreamed of.
If, of course, you're interested in the technical content. Like CRYPTO, this event is about very theoretical work. And again like CRYPTO, it has a fairly narrow focus: the application of formal methods to security problems. The security problems in question tend to change with the times: previous hot topics include covert channels and non-interference, calculi for access- control policies, and so on. The current hot topic seems to be the automated analysis of cryptographic protocols again. (This was really hot five years ago or so, but fell out of favor until recently.) If these things float your boat, this is the conference for you.
Having said that, let me admit that CSF is probably even more clique-y than CRYTO. The underlying cause is the same: the core group of attendees has been the same ever since it started, and the conference has historically been about them and their students. Now that CSF is a symposium, and therefore open to the public, this is becoming less and less true. I think the 'old guard' is being gradually replaced by a 'new guard', and that the new guard is interested in connecting CSF to a variety of other conferences.
RSA
RIght now, some colleague of mine is looking incredulously at their screen and asking, 'Does RSA even count?' The question is fair. Although RSA does have an academic 'track' with peer-reviewed academic papers, this only attracts 50 or so participants. The other 13,950 participants are where the action is: the trade floor.
RSA is the computer security trade show, with a slight emphasis on cryptography. Every cryptographer should go to RSA at some point in their lives. Why? you ask. What could you, a serious cryptographer, possibly get out of an event which opens with a freakin' song-and-dance number? (I'm not joking. It's actually quite impressive.) You will get two important lessons:
- A vivid lesson on how far the world of actual crypto usage lags behind theory, and
- An even more vivid lesson on how little that matters.
The reason to go to RSA is get a reality check. You will have no choice but to see what the world actually wants from cryptographers, and it's not deniable secure multi-party computation. The world would like some crypto that actually works, dammit, where they don't really know what they mean but are pretty sure that PKI ain't it. Just some crypto that lets them do their job and not have to worry about security pop-ups or certificate validation (which they don't understand anyway). One trip to RSA and you will know whether you care enough about the real world to roll up your sleeves and get your hands dirty in it. And if you don't, that's fine. For you, there's CRYPTO, CSF, and TCC. But in either case, you will have a better understanding of where exactly those 'theory' conferences fit in the much, much larger picture of the actual world.
(Also, if you are thinking of starting any sort of business in crypto, or pursuing work as a crypto consultant, you absolutely must attend this conference to get the lay of the land.)
(Right. That's what I've got. Anyone want to add their own impressions, or describe conferences I've missed?)