Research Engineer - Applied Cryptography Distributed Systems And Zero-Knowledge H/F - INRIA

A propos d'Inria

Inria, l'institut national de recherche dans les sciences et technologies du numérique, est en appui de l'État pour les stratégies nationales de recherche et d'innovation du numérique en tant qu'Agence de programmes. Inria mène plus de 300 projets de recherche et d'innovation avec ses 3500 scientifiques, ingénieurs et personnels d'appui, en partenariat avec les universités et l'écosystème numérique (entreprises, entrepreneurs, acteurs publics). Ensemble, nous explorons des domaines clés comme l'intelligence artificielle, la cybersécurité, l'informatique quantique, le Cloud, la transformation numérique de la santé, les jumeaux numériques ou encore les technologies numériques pour la défense. Nous construisons des solutions concrètes telles que des logiciels, des startups technologiques, des partenariats avec les entreprises du tissu national et des formations de pointe. Notre objectif : l'impact scientifique, technologique et industriel au service de la souveraineté numérique de la France.

Research engineer - Applied cryptography, distributed systems and zero-knowledge
Le descriptif de l'offre ci-dessous est en Anglais
Type de contrat : CDD

Contrat renouvelable : Oui

Niveau de diplôme exigé : Bac +5 ou équivalent

Fonction : Ingénieur scientifique contractuel

Contexte et atouts du poste

This research engineer position is part of the European IPCEI-CIS project (Important Project of Common European Interest - Next Generation Cloud Infrastructure and Services), within the DXP (Data Exchange Platform) project, carried out in collaboration with Amadeus and three Inria research teams: LORELEY, CEDAR and MAGELLAN.

The DXP project aims to design and develop an open-source solution for managing a federated and distributed data exchange platform, operating in an open, scalable and massively distributed environment across the entire cloud-edge continuum.

In this context, the successful candidate will join the LORELEY project team at the Inria Centre of the University of Lorraine, in Nancy. They will work in an environment at the interface between academic research and software development, interacting with researchers, engineers and industrial partners.

The Inria Centre of the University of Lorraine is one of Inria's nine centres and comprises twenty project teams distributed across Nancy, Strasbourg and Saarbrücken. Its activities involve more than 400 people, including scientists and research and innovation support staff, representing 45 different nationalities.

The Inria Centre is a major and recognised player in the field of digital sciences. It is located at the heart of a rich research, development and innovation ecosystem, comprising in particular highly innovative small and medium-sized enterprises, large industrial groups, competitiveness clusters, research and higher education institutions, laboratories of excellence and technological research institutes.

This position offers the opportunity to work on a topic at the crossroads of applied cryptography, distributed systems, privacy protection and zero-knowledge technologies, with the aim of implementing and evaluating an open-source prototype.

Mission confiée

End-to-end encryption (E2EE) systems must be able to authenticate users' public keys in order to protect against man-in-the-middle attacks. Existing solutions rely, in particular, on out-of-band channels [1], shared passwords [2], or centralised key distribution servers. These approaches have significant limitations in terms of usability, decentralisation and privacy protection.

Indeed, implementing an out-of-band channel that is both secure and intuitive in practice is challenging. Users often neglect password entropy, while comparing fingerprints is error-prone and time-consuming [3].

On the other hand, relying on a centralised trusted authority to distribute and authenticate public keys greatly simplifies the use and implementation of these systems. However, this centralisation introduces a single point of trust and failure, and may facilitate the collection or monitoring of associations between identifiers and public keys. Consequently, achieving secure and intuitive client authentication remains a major challenge for E2EE systems.

The objective of this position is to implement and evaluate a decentralised public key infrastructure that enables the authenticity of public keys to be verified while limiting the information exposed about users and their keys.

The solution under investigation will rely on zero-knowledge cryptographic techniques as well as on Key Transparency mechanisms, which aims for users to be able to verify that the public keys associated with them have not been modified or replaced without their knowledge. It must mitigate the risk of man-in-the-middle attacks while limiting the possibilities for user enumeration and the automated collection of the directory mapping identifiers to public keys.

[1] Zimmermann, P.R.: The official PGP user's guide. MIT press (1995)
[2] Boyko, V., MacKenzie, P., Patel, S.: Provably secure password-authenticated key exchange using diffie-hellman. In: Advances in Cryptology- Eurocrypt 2000. pp. 156-171. Springer (2000)
[3] Whitten, A., Tygar, J.D.: Why johnny can't encrypt: A usability evaluation of pgp 5.0. In: USENIX Security Symposium. vol. 348 (1999)

Principales activités

- Developing an end-to-end proof of concept for the distributed system.
- Integrating the various cryptographic primitives used by the system, including accumulators, commitments, signatures, SNARKs and hash functions.
- Integrating existing cryptographic libraries and combining their components to build the cryptographic constructions required by the system, including accumulators, commitments, signatures, SNARKs and hash functions.
- Conducting experiments to evaluate the performance, resource consumption and scalability of the solution.
- Contributing to the documentation and open-source publication of the work.

The position involves close collaboration with researchers from the Inria teams involved in the project. The engineer will contribute to implementation decisions and propose technical optimisations, while building on the scientific and cryptographic choices established as part of the research.

Compétences

Essential Skills:

- Experience in software development using at least one of the following programming languages: C++, Rust, Go or Python.
- Good knowledge of software design, testing and debugging.
- A strong interest in applied cryptography, cyber security, distributed systems and/or privacy protection.
- Ability to work on complex technical problems and read scientific literature in English.
- A Master's degree or equivalent qualification in computer science or applied mathematics.

Desirable Skills:

- Proficiency in Rust.
- Experience in developing open-source software.
- Experience with zero-knowledge frameworks and SNARKs (arkworks, Circom, gnark, etc.).
- Experience with distributed systems and/or peer-to-peer networks (libp2p, etc).

Avantages

- Subsidized meals
- Partial reimbursement of public transport costs
- Leave: 7 weeks of annual leave + 10 extra days off due to RTT (statutory reduction in working hours) + possibility of exceptional leave (sick children, moving home, etc.)
- Possibility of teleworking and flexible organization of working hours
- Professional equipment available (videoconferencing, loan of computer equipment, etc.)
- Social, cultural and sports events and activities
- Access to vocational training
- Social security coverage

Rémunération

From €2,692 gross per month, depending on qualifications and experience

• Python
• C++
• Anglais
• Peer-to-peer