About

My research interests span theoretical and applied cryptography and its applications throughout and beyond computing & data sciences. In my research, I often design and develop crypto algorithms with provable, composable security guarantees, deploy privacy-respecting systems for data scientists to work with data they cannot see, and examine the social aspects of cryptography, including its impacts on law and public policy.

Research topics

• Computer Science
• Computer Security
• Theoretical computer science
• Computer network
• Information Retrieval
• Internet privacy
• Programming language
• Database
• Mathematics
• Distributed computing
• Discrete mathematics
• Software engineering
• Algorithm
• Environmental health
• Medicine

Selected publications

• Making Sense of Private Advertising: A Principled Approach to a Complex Ecosystem

  Proceedings on Privacy Enhancing Technologies · 2026-01-01

  articleOpen access

  In this work, we model the end-to-end pipeline of the advertising ecosystem, allowing us to identify two main issues with the current trajectory of private advertising proposals. First, prior work has largely considered ad targeting and engagement metrics individually rather than in composition. This has resulted in privacy notions that, while reasonable for each protocol in isolation, fail to compose to a natural notion of privacy for the ecosystem as a whole, permitting advertisers to extract new information about the audience of their advertisements. The second issue serves to explain the first: we prove that perfect privacy is impossible for any, even minimally, useful advertising ecosystem, due to the advertisers' expectation of conducting market research on the results. Having demonstrated that leakage is inherent in advertising, we re-examine what privacy could realistically mean in advertising, building on the well-established notion of sensitive data in a specific context. We identify that fundamentally new approaches are needed when designing privacy-preserving advertising subsystems in order to ensure that the privacy properties of the end-to-end advertising system are well aligned with people's privacy desires.

  PublisherOA PDFDOI

• ORQ: Complex Analytics on Private Data with Strong Security Guarantees

  2025-10-01 · 4 citations

  preprintOpen access

  We present Orq, a system that enables collaborative analysis of large private datasets using cryptographically secure multi-party computation (MPC). Orq protects data against semi-honest or malicious parties and can efficiently evaluate relational queries with multi-way joins and aggregations that have been considered notoriously expensive under MPC. To do so, Orq eliminates the quadratic cost of secure joins by leveraging the fact that, in practice, the structure of many real queries allows us to join records and apply the aggregations "on the fly" while keeping the result size bounded. On the system side, Orq contributes generic oblivious operators, a data-parallel vectorized query engine, a communication layer that amortizes MPC network costs, and a dataflow API for expressing relational analytics—all built from the ground up.

  PublisherDOI

• Making Sense of Private Advertising: A Principled Approach to a Complex Ecosystem

  ArXiv.org · 2025-12-23

  articleOpen access

  In this work, we model the end-to-end pipeline of the advertising ecosystem, allowing us to identify two main issues with the current trajectory of private advertising proposals. First, prior work has largely considered ad targeting and engagement metrics individually rather than in composition. This has resulted in privacy notions that, while reasonable for each protocol in isolation, fail to compose to a natural notion of privacy for the ecosystem as a whole, permitting advertisers to extract new information about the audience of their advertisements. The second issue serves to explain the first: we prove that \textit{perfect} privacy is impossible for any, even minimally, useful advertising ecosystem, due to the advertisers' expectation of conducting market research on the results. Having demonstrated that leakage is inherent in advertising, we re-examine what privacy could realistically mean in advertising, building on the well-established notion of \textit{sensitive} data in a specific context. We identify that fundamentally new approaches are needed when designing privacy-preserving advertising subsystems in order to ensure that the privacy properties of the end-to-end advertising system are well aligned with people's privacy desires.

  PublisherOA PDF

• Decisional Diffie–Hellman Problem

  2025-01-01

  book-chapterSenior author
  PublisherDOI

• Making Sense of Private Advertising: A Principled Approach to a Complex Ecosystem

  arXiv (Cornell University) · 2025-12-23

  preprintOpen access

  In this work, we model the end-to-end pipeline of the advertising ecosystem, allowing us to identify two main issues with the current trajectory of private advertising proposals. First, prior work has largely considered ad targeting and engagement metrics individually rather than in composition. This has resulted in privacy notions that, while reasonable for each protocol in isolation, fail to compose to a natural notion of privacy for the ecosystem as a whole, permitting advertisers to extract new information about the audience of their advertisements. The second issue serves to explain the first: we prove that \textit{perfect} privacy is impossible for any, even minimally, useful advertising ecosystem, due to the advertisers' expectation of conducting market research on the results. Having demonstrated that leakage is inherent in advertising, we re-examine what privacy could realistically mean in advertising, building on the well-established notion of \textit{sensitive} data in a specific context. We identify that fundamentally new approaches are needed when designing privacy-preserving advertising subsystems in order to ensure that the privacy properties of the end-to-end advertising system are well aligned with people's privacy desires.

  PublisherDOI

• Accelerating Multi-Party Computation Using Heterogeneous Systems

  2025-09-15

  article

  Multi-party computation (MPC) allows multiple parties to compute with private data without sharing it. We have previously found that MPC through Secret Sharing has some advantages in data center deployments. But while MPC provides strong privacy guarantees, in Secret Sharing MPC, the protocol’s communication between parties often takes a significant portion of the total execution time. That is, adding MPC to applications like neural network training can increase the execution time from minutes to days. A significant fraction of this increased execution time is due to the use of generic TCP/IP networks and other communication overhead.We present advances to a system that accelerates Secret Sharing MPC using FPGA network cards, which is especially applicable for deployments where all parties are in the same data center. This approach makes improvements over previous work in this area. First, we replace TCP/IP with RDMA over FPGA SmartNICs; this sends data directly among memories without CPU involvement. And second, computation is overlapped with communication to avoid device idling.We implement the SmartNICs using AMD FPGAs with Coyote’s RDMA stack. The proof-of-concept application is a simple machine learning model. We performed layer-by-layer experiments to analyze latency. For the convolutional layers, the system achieves a 2.1× speedup compared to existing MPC frameworks. Moreover, based on these optimizations and analysis, we estimate that the machine learning workflow can achieve a 1.7× speedup compared to unoptimized MPC, potentially making MPC machine learning significantly more attractive.

  PublisherDOI

• Haven++: Batched and Packed Dual-Threshold Asynchronous Complete Secret Sharing with Applications

  IACR Communications in Cryptology · 2025-01-13 · 5 citations

  articleOpen access

  Asynchronous complete secret sharing (ACSS) is a foundational primitive in the design of distributed algorithms and cryptosystems that require confidentiality. ACSS permits a dealer to distribute a secret to a collection of N servers so that everyone holds shares of a polynomial containing the dealer's secret. This work contributes a new ACSS protocol, called Haven++, that uses packing and batching to make asymptotic and concrete advances in the design and application of ACSS for large secrets. Haven++ allows the dealer to pack multiple secrets in a single sharing phase, and to reconstruct either one or all of them later. For even larger secrets, we contribute a batching technique to amortize the cost of proof generation and verification across multiple invocations of our protocol. The result is an asymptotic improvement in the worst-case amortized communication and computation complexity, both for ACSS itself and for its application to asynchronous distributed key generation. Our ADKG based on Haven++ achieves, for the first time, an optimal worst case amortized communication complexity of κN without a trusted setup. To show the practicality of Haven++, we implement it and find that it outperforms the work of Yurek et al. (NDSS 2022) by more than an order of magnitude when there are malicious, faulty parties.

  PublisherOA PDFDOI

• Privacy-Preserving Machine Learning on Web Browsing for Public Opinion

  Lecture notes in computer science · 2025-11-23

  book-chapter
  PublisherDOI

• Murmurs of the Silenced: Secure Reporting of Misconduct Settlements

  2025-03-13 · 1 citations

  articleOpen access

  For decades, scholars debated the merits between resolving disputes by public adjudications or private settlements. This tension is particularly relevant in misconduct settlements, where wrongdoers can hide behind the confidentiality available in a private settlement. A paradigmatic example of this was the #MeToo movement and the revelation of serial sexual predators sheltered by secret settlements. Using Multi-Party Computation, a cryptographic technique that enables parties to provide private data for computation without giving up confidentiality, we contribute a fully-interwoven statutory-technological system that implements secure reporting of wrongful misconduct settlements, in order to provide oversight statistics to policymakers and to unmask repeatedly-settling parties for investigation. By providing a unique policy option that balances privacy with oversight, our proposal lessens the need to restrict settlement confidentiality, thereby protecting the autonomy of the parties to settle privately, if they so choose. More broadly, our proposal addresses the oversight complaints against settlements by scholars, and advances the discourse on the appropriate roles of adjudication and settlements in resolving disputes.

  PublisherDOI

• Efficient Byzantine Broadcast From Succinct Erasure Coding Proof System

  IEEE Transactions on Information Forensics and Security · 2025-01-01 · 1 citations

  article

  Byzantine broadcast (BC) is a fundamental problem in distributed systems. To build communication-efficient BC protocols, erasure coding is a key tool. In systems under the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">f</i> < <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i>/3 setting, where <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i> is the total number of parties (also called replicas) and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">f</i> is the number of Byzantine failures, correct replicas can simply encode the data block through erasure coding, share data fragments, and interact to validate that the decoded data is consistent with the original data block. Such a paradigm is powerful in primitives such as BC, asynchronous verifiable information dispersal, and atomic broadcast. However, in systems with corrupt majority or even in the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">f</i> < <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i>/2 setting, it becomes less straightforward to use erasure coding to build communication-efficient protocols. In this work, we introduce an erasure coding proof (ECP) system which allows the encoder to prove succinctly and non-interactively that an erasure-coded fragment is consistent with a constant-sized commitment to the original data block. Each fragment can be verified independently of the other fragments. We present two synchronous BC protocols from the ECP system, one under the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">f</i> < (1 − ϵ)<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i> assumption and one under the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">f</i> < <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i>/2 assumption, where ϵ is a constant and ϵ ∈ (0, 1). Both protocols improve the communication complexity and time complexity compared to the state-of-the-art BC protocols.

  PublisherDOI

Recent grants

• EAGER: SaTC: Early-Stage Interdisciplinary Collaboration: Multi-regulation computation

  NSF · $300k · 2019–2024

• InTrans: Modular Security on an Open Cloud

  NSF · $500k · 2019–2022

• CICI: RSARC: Trustworthy Computing over Protected Datasets

  NSF · $1.0M · 2017–2020

Frequent coauthors

• Matteo Maffei

  36 shared

• Deepak Garg

  Max Planck Institute for Software Systems

  36 shared

• Luca Viganò

  36 shared

• Limin Jia

  Carnegie Mellon University

  36 shared

• Ralf Küsters

  University of Stuttgart

  36 shared

• Ran Canetti

  20 shared

• Sarah Scheffler

  Carnegie Mellon University

  13 shared

• Andrei Lapets

  13 shared

Labs

• Faculty of Computing & Data SciencesPI

Education

• Ph.D., Mathematics

  Massachusetts Institute of Technology (MIT)

  2010

• B.S.

  Duke University

  2005

Awards & honors

• 2026: General chair of IACR CRYPTO 2026
• 2025: CS&Law Best Paper and SOSP Distinguished Artifact awar…
• 2024: Hosted Dan Roche as a visiting professor at BU
• 2023: Received CDS Distinguished Leadership Award and a Hari…
• 2022: Hosted Civic Voices event to discuss privacy tech with…