SecureMailScope: AI-Assisted Cryptographic Security Posture Assessment for Secure Email Communications
National Technical Research Organisation (NTRO) · Blockchain & Cybersecurity · Software
One of the cleanest NTRO problems — you generate your own data, the core is reliable deterministic protocol analysis, and the demo constructs itself, so build the assessment solidly and be honest that the AI is for prioritisation rather than the core verdict.
Data: Synthetic — participants generate IMAPS/POP3S/SMTPS traffic with any mail server/client and capture pcap
What it actually is
Email still runs on SMTP, IMAP and POP3, and even with TLS many deployments have weak crypto — obsolete TLS versions, weak ciphers, broken STARTTLS, bad certificates — that leaves them open to interception and downgrade attacks. The ask is a passive tool that reads captured email traffic and automatically assesses its cryptographic security posture, flagging and prioritising the weaknesses.
What to build
A passive network-forensic framework that ingests PCAP files of SMTP, IMAP and POP3 traffic, reconstructs the email communication sessions, identifies the encryption transitions including STARTTLS upgrades, analyses each TLS negotiation for version and cipher suite, validates the presented certificates, detects cryptographic weaknesses such as downgrade opportunities and expired or misconfigured certificates, and uses ML to classify the risk level, flag anomalous TLS behaviour and generate prioritised, actionable remediation recommendations for a SOC or incident-response team.
Smallest thing that wins the room
Feed in a PCAP containing one properly secured email session and one with a STARTTLS downgrade to an obsolete TLS version and a weak cipher, and show the tool reconstructing both sessions, flagging the weak one with the specific crypto failures, and ranking it by risk with a concrete remediation.
How crowded this one gets
A guess, projected from the 2025 statements — the last year where both the submission counts and the winners were published.
Quieter than 81% of the 226 · #44 of 226 by expected field
Few teams are likely to go here. The best odds on the board come from statements like this.
Why: defence, intelligence and space bodies drew small fields.
This is a guess, not a fact
Nobody has published 2026’s numbers yet. This is an analysed estimate from last year’s pattern, so please do not take it as the truth — check the live counter on the SIH portal before you decide anything. The range covers the middle half of likely outcomes, so one statement in two lands outside it. Entry closes at 500 ideas per statement, so no range goes past that — a statement that reaches the cap fills and shuts rather than drawing an unlimited crowd. The model reads only three things a team can see before choosing — software or hardware, the theme, and what kind of body posted it — and those explain about a quarter of the variation in last year’s field sizes (R² 0.25 on held-out statements). Trust the band more than the number, and the ordering more than either. It cannot see how good your idea is, which is the part that actually decides it.
The scores
The number is the shorthand. The line under it is the reason.
Acceptance potential
4/5A strong pick — you generate your own data so there is no sourcing risk, the specification is complete, the core protocol analysis is deterministic and reliable rather than dependent on shaky model accuracy, and it addresses a genuine gap since existing tools decode traffic but do not assess crypto posture.
Feasibility
4/5The description explicitly says participants generate their own PCAP data with any mail server and client, which removes the data barrier entirely, and TLS handshake parsing and certificate validation are well-supported in existing libraries, so the whole framework is buildable.
Innovation scope
3/5Much of this is deterministic protocol analysis dictated by TLS standards, so the AI adds value mainly in anomaly detection and risk prioritisation rather than in the core assessment, which is rule-based by nature.
Clarity
5/5The description names the protocols, the specific weaknesses to detect, the reconstruction and validation steps, the intended users and how to generate the data, making the requirement exceptionally complete.
Effort
HeavySession reconstruction from PCAP, TLS negotiation analysis, certificate validation, weakness detection and the risk-prioritisation layer are focused, well-bounded pieces on data you generate yourself.
Demo-ability
EasyA good session and a downgraded session side by side, with the weak one flagged and ranked, is a clean, concrete demonstration you can construct exactly to show the tool's value.
In its favour
- Green flag: You generate your own PCAP data with any mail server, so there is zero data-sourcing risk and you can craft exactly the weak configurations you want to demonstrate
- Green flag: The core analysis is deterministic protocol inspection, so most of your verdict is reliable ground truth rather than model output
- Green flag: The good-session-versus-downgraded-session demo is clean, concrete and directly proves the tool's value
- Green flag: It fills a real gap — existing tools decode traffic but do not assess cryptographic posture or prioritise remediation
Against it
- Red flag: Much of this is rule-based protocol analysis, so be honest that the AI adds value in prioritisation and anomaly detection rather than doing the core assessment, or the ML framing looks bolted on
- Red flag: Once TLS is fully established the traffic is encrypted, so a passive tool sees the handshake and certificate but not the content, which bounds what you can assess
- Red flag: Modern email increasingly uses TLS 1.3 which resists downgrade, so ensure your test data includes the weak legacy configurations the tool is meant to catch
- Red flag: Certificate validation has many edge cases, and getting chain validation subtly wrong produces false findings
What you will be writing
- PCAP session reconstruction (Scapy / pyshark)
- TLS handshake + cipher suite analysis
- X.509 certificate validation
- STARTTLS downgrade detection
- Risk classification + anomaly detection ML
- Prioritised remediation reporting dashboard
- Network forensics
- Email security
- TLS/cryptographic assessment
Prior art to read before you start
passive crypto posture assessment · TLS negotiation analysis · email protocol security auditing
Analysed by Claude Opus. Every score above is a judgment call with its reasoning attached — kindly cross-check this against the official statement on the SIH portal before your team commits to it.