Research engineer – Applied cryptography, distributed systems and zero-knowledge

Context
This research engineer position is part of the European IPCEI-CIS project (Important Project of Common European Interest – Next Generation Cloud Infrastructure and Services), within the DXP (Data Exchange Platform) project, carried out in collaboration with Amadeus and three Inria research teams: LORELEY, CEDAR and MAGELLAN.
The DXP project aims to design and develop an open-source solution for managing a federated and distributed data exchange platform, operating in an open, scalable and massively distributed environment across the entire cloud-edge continuum.
In this context, the successful candidate will join the LORELEY project team at the Inria Centre of the University of Lorraine, in Nancy. They will work in an environment at the interface between academic research and software development, interacting with researchers, engineers and industrial partners.
The Inria Centre of the University of Lorraine is one of Inria's nine centres and comprises twenty project teams distributed across Nancy, Strasbourg and Saarbrücken. Its activities involve more than 400 people, including scientists and research and innovation support staff, representing 45 different nationalities.
The Inria Centre is a major and recognised player in the field of digital sciences. It is located at the heart of a rich research, development and innovation ecosystem, comprising in particular highly innovative small and medium-sized enterprises, large industrial groups, competitiveness clusters, research and higher education institutions, laboratories of excellence and technological research institutes.
This position offers the opportunity to work on a topic at the crossroads of applied cryptography, distributed systems, privacy protection and zero-knowledge technologies, with the aim of implementing and evaluating an open-source prototype.
Assignment
End-to-end encryption (E2EE) systems must be able to authenticate users' public keys in order to protect against man-in-the-middle attacks. Existing solutions rely, in particular, on out-of-band channels [1], shared passwords [2], or centralised key distribution servers. These approaches have significant limitations in terms of usability, decentralisation and privacy protection.
Indeed, implementing an out-of-band channel that is both secure and intuitive in practice is challenging. Users often neglect password entropy, while comparing fingerprints is error-prone and time-consuming [3].
On the other hand, relying on a centralised trusted authority to distribute and authenticate public keys greatly simplifies the use and implementation of these systems. However, this centralisation introduces a single point of trust and failure, and may facilitate the collection or monitoring of associations between identifiers and public keys. Consequently, achieving secure and intuitive client authentication remains a major challenge for E2EE systems.
The objective of this position is to implement and evaluate a decentralised public key infrastructure that enables the authenticity of public keys to be verified while limiting the information exposed about users and their keys.
The solution under investigation will rely on zero-knowledge cryptographic techniques as well as on Key Transparency mechanisms, which aims for users to be able to verify that the public keys associated with them have not been modified or replaced without their knowledge. It must mitigate the risk of man-in-the-middle attacks while limiting the possibilities for user enumeration and the automated collection of the directory mapping identifiers to public keys.
[1] Zimmermann, P.R.: The official PGP user’s guide. MIT press (1995)
[2] Boyko, V., MacKenzie, P., Patel, S.: Provably secure password-authenticated key exchange using diffie-hellman. In: Advances in Cryptology- Eurocrypt 2000. pp. 156–171. Springer (2000)
[3] Whitten, A., Tygar, J.D.: Why johnny can’t encrypt: A usability evaluation of pgp 5.0. In: USENIX Security Symposium. vol. 348 (1999)
Main activities
Developing an end-to-end proof of concept for the distributed system.
Integrating the various cryptographic primitives used by the system, including accumulators, commitments, signatures, SNARKs and hash functions.
Integrating existing cryptographic libraries and combining their components to build the cryptographic constructions required by the system, including accumulators, commitments, signatures, SNARKs and hash functions.
Conducting experiments to evaluate the performance, resource consumption and scalability of the solution.
Contributing to the documentation and open-source publication of the work.
The position involves close collaboration with researchers from the Inria teams involved in the project. The engineer will contribute to implementation decisions and propose technical optimisations, while building on the scientific and cryptographic choices established as part of the research.
Skills
Essential Skills:
Experience in software development using at least one of the following programming languages: C++, Rust, Go or Python.
Good knowledge of software design, testing and debugging.
A strong interest in applied cryptography, cyber security, distributed systems and/or privacy protection.
Ability to work on complex technical problems and read scientific literature in English.
A Master's degree or equivalent qualification in computer science or applied mathematics.
Desirable Skills:
Proficiency in Rust.
Experience in developing open-source software.
Experience with zero-knowledge frameworks and SNARKs (arkworks, Circom, gnark, etc.).
Experience with distributed systems and/or peer-to-peer networks (libp2p, etc).