Research

My research is in theoretical and applied cryptography. I design cryptographic systems that provide rigorous security while remaining useful in practice. My recent work focuses on privacy-preserving search and data access, authentication from noisy sources, and the security of election systems.

Current Research

Privacy-preserving search and data access

Cloud services need to search and process data without exposing the underlying contents or access patterns. My work studies searchable encryption, private information retrieval, privacy-preserving range queries, and oblivious data structures, with an emphasis on reducing leakage while retaining practical performance. Recent projects address multi-adversary and replication-free search, multi-key access control, proximity search for iris biometrics, and oblivious key-value stores that support updates and controlled access.

Authentication from noisy sources

Many useful authentication sources are noisy: repeated measurements of a biometric or hardware device are similar, but not identical. My work studies the fundamental limits of fuzzy extraction and develops computationally secure constructions for practical sources, including the human iris and physical unclonable functions. Recent projects improve fuzzy extractors, derive cryptographic-strength keys from iris measurements, and combine image processing with cryptographic protection; ThirdEye uses triplet-loss training to study normalization-free iris recognition.

Election security and trustworthy audits

I develop cryptographic and statistical tools for strengthening election systems, with current work on risk-limiting comparison audits, direct ballot selection, statistical ballot manifests, and election contestation. I also study how adversarial machine learning can threaten the physical processes surrounding paper ballots and how election infrastructure can be designed to remain trustworthy under realistic attacks. Related secure-computation research addresses identifying cheaters, auditing computations, and opening inputs in exceptional circumstances while preserving normal protocol efficiency.

Selected Publications (2009–2026)

2026

“Oblivious Single Access Machines are Concretely Efficient”, with Sage Pia, Ananya Appan, Maryam Rezapour, Amey Shukla, Nikhil Date, Ling Ren, and David Heath.This work improves the practical performance of oblivious computation for programs that manipulate pointers and graph-like data. It co-designs pointer-friendly ORAM techniques and new pointer-management algorithms, making automatically compiled oblivious graph algorithms substantially more efficient.
“SPARQ: Scalable Privacy-preserving Aggregate Range Queries”, with Mahdieh Heidaripour, Maryam Rezapour, Hoda Maleki, and Gagan Agrawal.SPARQ studies how to answer aggregate range queries while hiding sensitive data from the service performing the computation. The goal is to make privacy-preserving analytics scale to large datasets and multidimensional queries without revealing the underlying records.
“Updatable Oblivious Key Value Stores with Access Control and Application to Multi Key Searchable Encryption”, with Ariel Hamlin, Arinjita Paul, Maryam Rezapour, Ronak Sahu, Amey Shukla, and Mason Stuart. Subsumes the earlier work “MARS: Low-Leakage Multi Adversarial Owner and Reader Replication-free Searchable Encryption from Private Information Retrieval.”This paper introduces an updatable oblivious key-value store that supports insertions while protecting both stored values and access patterns. Its fine-grained access control also supports multi-key searchable encryption without replicating the data for every authorized user.
“ProxCode: Efficient Biometric Proximity Searchable Encryption from Error Correcting Codes”, with Maryam Rezapour. CT-RSA 2026.ProxCode uses error-correcting codes to support efficient proximity searches over encrypted biometric data. The construction is designed to improve the practicality of approximate matching while keeping the biometric representations protected.
“Sublinear Risk-Limiting Audits from Direct Ballot Selection and Statistical Ballot Manifests”, with Abigail Harrison and Alexander Russell. CCS 2026.The paper addresses the high operational cost of creating accurate ballot manifests for risk-limiting audits. It proposes statistical manifest verification and direct ballot selection, reducing the amount of ballot-handling work while retaining rigorous guarantees about detecting an incorrect election outcome.
“Analyzing Physical Adversarial Example Threats to Machine Learning in Election Systems,” with Khaleque Md. Aashiq Kamal, Surya Eada, Aayushi Verma, Subek Acharya, Adrian Yemin, and Kaleel Mahmood.This work examines how physical adversarial examples could affect machine-learning components used in election systems. It develops a threat-oriented analysis of attacks that manipulate real-world inputs rather than only digital test data.

2025

“Fuzzy Extractors are Practical: Cryptographic Strength Key Derivation from the Iris,” with Amey Shukla, Luke Demarest, Sohaib Ahmad, Caleb Manicke, Alexander Russell, and Sixia Chen. CCS 2025.This paper builds an end-to-end iris-based key-derivation system using fuzzy extractors. It connects practical iris processing with cryptographic security analysis, addressing the noise and limited entropy that make biometric key derivation difficult.
“Private Eyes: Zero-Leakage Iris Searchable Encryption”, with Julie Ha, Chloé Cachet, Luke Demarest, and Sohaib Ahmad. CODASPY 2025.Private Eyes studies searchable encryption for iris biometrics while targeting zero leakage about the searched biometric information. The work combines biometric similarity search with cryptographic protection so that a server can support matching without learning the underlying iris data.
“Busting the Paper Ballot: Voting Meets Adversarial Machine Learning”, with Kaleel Mahmood, Caleb Manicke, Ethan Rathbun, Aayushi Verma, Sohaib Ahmad, Nicholas Stamatakis, and Laurent Michel. CCS 2025.This paper studies attacks in which an adversary uses machine learning to influence or exploit the physical processes surrounding paper ballots. It connects election security with adversarial-ML threat models and identifies consequences for the design and auditing of voting systems.

2024

“Upgrading Fuzzy Extractors”, with Chloé Cachet, Ariel Hamlin, and Maryam Rezapour. ACNS 2024.This work revisits the design of fuzzy extractors for noisy, structured sources such as biometrics. It develops stronger constructions and clarifies how the extractor can be upgraded to support more realistic source models and security requirements.
“Organizing Records for Retrieval in Multi-Dimensional Range Searchable Encryption,” with Mahdieh Heidaripour, Ladan Kian, Maryam Rezapour, Mark Holcomb, Gagan Agrawal, and Hoda Maleki. SECRYPT 2024.The paper develops data-organization techniques for multidimensional range queries over encrypted records. Its focus is on making encrypted retrieval practical while preserving the confidentiality of both the data and the query-related information.
“The Decisive Power of Indecision: Low-Variance Risk-Limiting Audits and Election Contestation via Marginal Mark Recording,” with Rashmi Pai and Alexander Russell. USENIX Security 2024.This work studies how election contests can be audited when the reported margin is small or uncertain. It introduces low-variance techniques based on marginal marks that improve the efficiency and reliability of risk-limiting audits.
“Impossibility of Efficient Information-Theoretic Fuzzy Extraction”. Designs, Codes and Cryptography, 2024.This paper proves limits on information-theoretically secure fuzzy extraction. The results show that some broad classes of noisy sources cannot support efficient extractors with all desired security and key-length properties, helping identify where computational assumptions are necessary.

2023

“Private Eyes: Zero-Leakage Iris Searchable Encryption,” with Julie Ha, Chloé Cachet, Luke Demarest, and Sohaib Ahmad.This paper develops a searchable-encryption system for iris biometrics that aims to prevent leakage from the search process. It addresses the tension between supporting approximate biometric matching and protecting the biometric templates being queried.
“Upgrading Fuzzy Extractors,” with Chloé Cachet, Ariel Hamlin, and Maryam Rezapour.The paper studies how existing fuzzy-extractor constructions can be strengthened for practical noisy sources. It provides a framework for improving their security and robustness rather than treating the extractor as a purely abstract primitive.
“Impossibility of Efficient Information-Theoretic Fuzzy Extraction,” with Luke Demarest and Alexander Russell.This work identifies source distributions for which efficient information-theoretic fuzzy extraction is impossible. The negative results explain why computational security or additional assumptions may be needed for practical biometric key derivation.
“Adaptive Risk-Limiting Comparison Audits,” with Abigail Harrison and Alexander Russell. IEEE Symposium on Security and Privacy 2023. Earlier version: “Lazy Risk-Limiting Ballot Comparison Audits.”This paper develops risk-limiting comparison audits that adapt their sampling strategy as evidence is collected. The approach seeks to reduce the expected number of ballot comparisons while preserving a rigorous bound on the chance of failing to detect an incorrect result.

2022

“Proximity Searchable Encryption for the Iris Biometric”, with Chloé Cachet, Sohaib Ahmad, Luke Demarest, and Ariel Hamlin. AsiaCCS 2022.This work supports approximate, rather than exact, searches over encrypted iris data. It combines proximity search with biometric representations so that a server can identify close matches without receiving the raw biometric.
“Nonmalleable Digital Lockers and Robust Fuzzy Extractors in the Plain Model”, with Daniel Apon, Chloé Cachet, Peter Hall, and Feng-Hao Liu. ASIACRYPT 2022.The paper combines robust fuzzy extraction with nonmalleable digital lockers, protecting derived keys even when an attacker tampers with stored helper data. It gives constructions in the plain model, avoiding reliance on a common reference string.
“Inverting Biometric Models with Fewer Samples: Incorporating the Output of Multiple Models,” with Sohaib Ahmad and Kaleel Mahmood. IJCB 2022.This work studies privacy attacks that reconstruct or infer biometric information from model outputs. It shows how combining outputs from multiple biometric models can improve an attacker’s ability to invert the representation, highlighting risks in deployed recognition systems.

2021

“Reusable Fuzzy Extractors for Low-Entropy Distributions,” with Ran Canetti, Omer Paneth, Leonid Reyzin, and Adam D. Smith. Journal of Cryptology, 2021. Includes the earlier work “Key Derivation from Noisy Sources with More Errors than Entropy.”This paper studies fuzzy extractors for sources whose entropy is too low for standard constructions and whose readings may be reused by multiple providers. It gives reusable constructions under computational assumptions and characterizes the source conditions needed for security.
“Code Offset in the Exponent”, with Luke Demarest and Alexander Russell. ITC 2021.The construction adapts code-offset techniques to a cryptographic group by encoding the noisy source through exponentiation. This supports reusable fuzzy extraction for structured, low-entropy sources with confidence information, including biometric and PUF applications.

2020

“Computational Fuzzy Extractors,” with Xianrui Meng and Leonid Reyzin. Information and Computation, 2020.This work formulates fuzzy extraction with computational rather than information-theoretic security. The resulting constructions can provide longer keys and reusability for sources where traditional unconditional guarantees are too restrictive.
“When Are Fuzzy Extractors Possible?” with Leonid Reyzin and Adam D. Smith. IEEE Transactions on Information Theory, 2020.This paper gives necessary and sufficient conditions for building fuzzy extractors from noisy sources. The characterization separates fundamental information-theoretic limitations from limitations caused by a particular construction.
“Same Point Composable and Nonmalleable Obfuscated Point Functions”, with Peter Fenteany. ACNS 2020.The paper constructs point obfuscators that remain secure when the same point is obfuscated repeatedly and when an adversary tampers with the obfuscation. These tools enable nonmalleable digital lockers, which protect a key derived from a password or other secret.
“Resist: Reconstruction of Irises from Templates,” with Sohaib Ahmad. IJCB 2020.This work evaluates whether an iris image can be reconstructed from a stored iris-recognition template. The results demonstrate a concrete privacy threat for biometric systems and motivate cryptographic protection of templates and matching operations.

2019

“ThirdEye: Triplet Based Iris Recognition without Normalization”, with Sohaib Ahmad. BTAS 2019.This paper uses triplet-loss training to test whether the normalization stage traditionally used in iris recognition is always necessary. The system shows that modern learned representations can reduce dependence on normalization, while also exposing the importance of segmentation and sensor conditions.
“Continuous-Source Fuzzy Extractors: Source Uncertainty and Insecurity,” with Lowen Peng. ISIT 2019.This work asks whether one fuzzy-extractor construction can securely handle every source with sufficient fuzzy min-entropy. It gives negative results by constructing source families that cannot all be handled simultaneously, clarifying the limits of universal key derivation.
“Cryptographic Authentication from the Iris,” with Sailesh Simhadri and James Steel. ISC 2019. Subsumes the earlier work “Reusable Authentication from the Iris.”The paper builds an authentication system that derives a cryptographic key from an iris measurement despite noise between readings. It integrates biometric processing and fuzzy-extractor techniques, while addressing privacy and the difficulty of enrolling the same biometric with multiple providers.
“Environmental Authentication in Malware”, with Jeremy Blackthorne, Benjamin Kaiser, and Bülent Yener. LatinCrypt 2019.This paper formalizes malware that derives a decryption key from properties of its execution environment. It characterizes when environmental differences can provide security against an analyst and shows why repeated or resettable analysis environments create fundamental challenges.
“FASHION: Functional and Attack Graph Secured Hybrid Optimization of Virtualized Networks”, with Devon Callahan, Timothy Curry, Daniel Davidson, Heytem Zitoun, and Laurent Michel. IEEE Transactions on Dependable and Secure Computing, 2022.FASHION jointly optimizes network functionality, security, performance, and cost instead of treating these requirements independently. Its layered approach produces configurations that satisfy reachability, bandwidth, and risk constraints for software-defined networks.

2018

“Unconstrained Iris Segmentation Using Convolutional Neural Networks,” with Sohaib Ahmad. ACCV Workshops 2018.This paper applies convolutional neural networks to the first stage of iris recognition: identifying which pixels belong to the iris. The method generalizes across environments and sensors, while showing that modest retraining can improve performance when the imaging conditions change.
“Pseudoentropic Isometries: A New Framework for Fuzzy Extractor Reusability,” with Quentin Alamélou, Paul-Edmond Berthier, Chloé Cachet, Stéphane Cauchie, Philippe Gaborit, and Sailesh Simhadri. AsiaCCS 2018.This work introduces a framework for constructing reusable fuzzy extractors from pseudoentropic isometries. It broadens the tools available for deriving keys from noisy sources that may be enrolled with more than one service.

2017

“Public Key Cryptosystems with Noisy Secret Keys,” with Charles Herder, Marten van Dijk, and Srinivas Devadas.This work develops public-key techniques for secrets that are noisy across repeated observations. It connects computational fuzzy extraction with practical hardware and biometric settings where an exact, stable secret is unavailable.
“Catching MPC Cheaters: Identification and Openability”, with Robert K. Cunningham and Sophia Yakoubov. ICITS 2017.The paper strengthens secure multi-party computation with identifiable abort, third-party auditability, and openability when participants provide false inputs. Its protocol preserves the normal efficiency of the computation and performs additional work only when cheating is detected.
“SoK: Cryptographically Protected Database Search,” with Mayank Varia, Arkady Yerukhimovich, Emily Shen, Ariel Hamlin, Vijay Gadepally, Richard Shay, John Darby Mitchell, and Robert K. Cunningham. IEEE Symposium on Security and Privacy 2017.This systematization surveys the security and performance tradeoffs in searchable encryption and related database-search techniques. It organizes the leakage revealed by encrypted search and highlights the gap between formal security definitions and deployed systems.
“FPGA Implementation of a Cryptographically-Secure PUF Based on Learning Parity with Noise”, with Chenglu Jin, Charles Herder, Lin Ren, Phuong Ha Nguyen, Srinivas Devadas, and Marten van Dijk. Cryptography 1(3), 2017.This paper gives an FPGA implementation of a PUF protocol based on computational fuzzy extraction and Learning Parity with Noise. The design corrects significant measurement noise without requiring irreversible hardware updates and demonstrates how cryptographic assumptions can improve practical PUF efficiency.

2016

“When Are Fuzzy Extractors Possible?” with Leonid Reyzin and Adam D. Smith. ASIACRYPT 2016. Earlier version: “When Are Fuzzy Extractors Possible?”This paper characterizes when a noisy source contains enough usable information to support fuzzy extraction. The result provides necessary and sufficient conditions, giving a foundation for distinguishing impossible source models from those that admit secure constructions.
“Reusable Fuzzy Extractors for Low-Entropy Distributions,” with Ran Canetti, Omer Paneth, Leonid Reyzin, and Adam D. Smith. EUROCRYPT 2016.This work develops fuzzy extractors for sources with low entropy and repeated use across multiple providers. The construction supports realistic correlations between readings while maintaining computational security and reusability.

2015

Strong Key Derivation from Noisy Sources. Ph.D. dissertation, Boston University, 2015.This dissertation develops cryptographic methods for deriving stable keys from noisy, high-entropy sources. It brings together fuzzy extractors, computational security, information leakage, and applications to biometrics and hardware devices.
“A Unified Approach to Deterministic Encryption: New Constructions and a Connection to Computational Entropy”, with Adam O’Neill and Leonid Reyzin. Journal of Cryptology, 2015.This paper gives a unified way to construct deterministic public-key encryption from trapdoor functions. It also connects the security of deterministic encryption to computational entropy, clarifying how much structure can safely be exposed for equality testing and search.
“Iris Biometric Security Challenges and Possible Solutions: For Your Eyes Only? Using the Iris as a Key,” with Gene Itkis, Venkat Chandar, Joseph P. Campbell, and Robert K. Cunningham. IEEE Signal Processing Magazine, 2015.This article examines the promise and security challenges of using the iris as a cryptographic key source. It explains why biometric noise, template protection, and the inability to replace a compromised biometric make cryptographic key derivation substantially harder than ordinary recognition.
“Unifying Leakage Classes: Simulatable Leakage and Pseudoentropy”, with Ariel Hamlin. ICITS 2015.This work relates different ways of measuring information leakage from cryptographic systems. By connecting simulatable leakage with pseudoentropy, it provides a common language for analyzing what an adversary learns even when the protected data is never directly revealed.

2014

“Robust Keys from Physical Unclonable Functions”, with Merrielle Spain, Kyle Ingols, and Robert K. Cunningham. HOST 2014.This paper studies how to derive cryptographic keys from the noisy physical responses of PUFs. It focuses on robustness: the device should reproduce the same key across measurements while making it difficult for an attacker to predict or clone the response.

2013

“Computational Fuzzy Extractors”, with Xianrui Meng and Leonid Reyzin. ASIACRYPT 2013.This paper develops fuzzy extractors with computational security, allowing the construction to rely on the difficulty of solving a cryptographic problem. The approach is designed to support stronger practical parameters than information-theoretic fuzzy extractors can provide for some sources.

2012

“DSKE: Dynamic Set Key Encryption,” with Galen E. Pickard, Roger I. Khazan, and Joseph A. Cooley. LCN Workshops 2012.DSKE addresses secure communication for groups whose membership changes over time. The construction updates group keys efficiently so that joining and leaving members do not require encrypting a new message separately for every participant.
“A Unified Approach to Deterministic Encryption: New Constructions and a Connection to Computational Entropy”, with Adam O’Neill and Leonid Reyzin. TCC 2012.
“Computational Entropy and Information Leakage,” with Leonid Reyzin. Master’s thesis, 2012.This thesis develops connections between computational entropy and the information that leaks from cryptographic computations. These ideas support later analyses of deterministic encryption and searchable encryption, where some controlled leakage is intentional.

2010

“GROK: A Practical System for Securing Group Communications,” with Joseph A. Cooley, Roger I. Khazan, and Galen E. Pickard. NCA 2010.GROK is a practical secure group-communication system designed for changing membership and intermittently connected networks. The project emphasized implementation and deployment, including secure chat across aircraft operating in and out of communication range.
“ASE: Authenticated Statement Exchange,” with Roger I. Khazan, Joseph A. Cooley, Galen E. Pickard, and Daniil M. Utin. NCA 2010.ASE provides a protocol for exchanging statements with cryptographic authentication in a group setting. It complements the group-communication work by addressing how participants can establish confidence in the origin and integrity of exchanged information.

For a complete and automatically updated list of publications, see my Google Scholar profile.

Code and Research Repositories

Earlier Research

Earlier projects addressed secure group communication, deterministic encryption, searchable encryption, fuzzy extractors, physical unclonable functions, and cryptographic authentication from iris biometrics. These projects established the foundation for my current work on practical cryptography with strong, explicit security guarantees.