Upload your resume. PhdFit's six research agents compare your background with faculty profiles, recent publications, lab focus, and outreach opportunities, then rank professors with evidence you can review.
Ask how her lab is extending interpretability methods into fairness audits for real-world AI systems.
Brown University · Computer Science
Active 1998–2026
Anna Lysyanskaya is the James A. and Julie N. Brown Professor of Computer Science at Brown University. Her research area is Cryptography, with a particular focus on privacy-enhancing technologies that enable individuals to conduct their daily online activities without revealing unnecessary personal data. She is especially proud of her work on anonymous credentials and electronic cash, and she is also interested in broader and foundational cryptographic questions. Currently on sabbatical in Fall 2024, she will teach CSCI1040: The Basics of Cryptographic Systems in Spring 2025. In addition to her academic duties, she has been elected to serve as the Vice Chair of the Faculty Executive Committee at Brown University, with her service beginning after her sabbatical. She also serves on the Board of Directors of the International Association for Cryptologic Research (IACR) and the Electronic Privacy Information Center (EPIC).
Lecture notes in computer science · 2026-01-01
Device-Bound Anonymous Credentials With(out) Trusted Hardware
Lecture notes in computer science · 2026-01-01
CAREER: Efficient Cryptographic Protocols for Secure and Private Electronic Transactions
NSF · $464k · 2004–2011
TWC: Small: Empowering Anonymity
NSF · $500k · 2014–2017
CT-ISG: Reconciling Accountability with Anonymity in P2P Systems
NSF · $350k · 2006–2010
Jan Camenisch
Melissa Chase
Microsoft (United States)
Alptekın Küpçü
Markulf Kohlweiss
Mira Belenkiy
Foteini Baldimtsi
George Mason University
Research in Cryptography, focusing on privacy-enhancing technologies and foundational cryptographic questions.
Ph.D., Cryptography
Brown University
PhdFit ranks faculty by your research interests, methods, and publications — grounded in their actual work, not templates.
Lattice-Based Accumulator and Application to Anonymous Credential Revocation
Lecture notes in computer science · 2026-01-01
Everlasting Anonymous Rate-Limited Tokens
Lecture notes in computer science · 2025-12-06 · 1 citations
Adaptive UC NIZK for Practical Applications
Lecture notes in computer science · 2025-10-01
Lecture notes in computer science · 2025-12-04
Many foundational results in the literature of consensus follow the Dolev-Yao model (FOCS ’81), which treats digital signatures as ideal objects with perfect correctness and unforgeability. However, no work has yet formalized an ideal signature scheme that is both suitable for this methodology and possible to instantiate, or a composition theorem that ensures security when instantiating it cryptographically. The Universal Composition (UC) framework would ensure composition if we could specify an ideal functionality for signatures and prove it UC-realizable. Unfortunately, all signature functionalities heretofore proposed are problematic when used to construct higher-level protocols: either the functionality internally computes a computationally secure signature, and therefore higher-level protocols must rely upon computational assumptions, or else the functionality introduces a new attack surface that does not exist when the functionality is realized. As a consequence, no consensus protocol has ever been analyzed in a modular way using existing ideal signature functionalities. We propose a new unstoppable ideal functionality for signatures that is UC-realized exactly by the set of standard EUF-CMA signature schemes that are consistent and work in linear time in the length of the message. No adversary can prevent honest parties from obtaining perfectly ideal signature services from our functionality. We showcase its usefulness by presenting the first modular analysis of the Dolev-Strong broadcast protocol (SICOMP ’83). Our result can be interpreted as a step toward a sound realization of the Dolev-Yao methodology. We also generalize our result to the threshold setting.
IACR Communications in Cryptology · 2024-07-08 · 1 citations
To be useful and widely accepted, automated contact tracing schemes (also called exposure notification) need to solve two seemingly contradictory problems at the same time: they need to protect the anonymity of honest users while also preventing malicious users from creating false alarms. In this paper, we provide, for the first time, an exposure notification construction that guarantees the same levels of privacy and integrity as existing schemes but with a fully malicious database (notably similar to Auerbach et al. CT-RSA 2021) without special restrictions on the adversary. We construct a new definition so that we can formally prove our construction secure. Our definition ensures the following integrity guarantees: no malicious user can cause exposure warnings in two locations at the same time and that any uploaded exposure notifications must be recent and not previously uploaded. Our construction is efficient, requiring only a single message to be broadcast at contact time no matter how many recipients are nearby. To notify contacts of potential infection, an infected user uploads data with size linear in the number of notifications, similar to other schemes. Linear upload complexity is not trivial with our assumptions and guarantees (a naive scheme would be quadratic). This linear complexity is achieved with a new primitive: zero knowledge subset proofs over commitments which is used by our "no cloning" proof protocol. We also introduce another new primitive: set commitments on equivalence classes, which makes each step of our construction more efficient. Both of these new primitives are of independent interest.
Bruisable Onions: Anonymous Communication in the Asynchronous Model
Lecture notes in computer science · 2024-12-01
Symmetric and Dual PRFs from Standard Assumptions: A Generic Validation of a Prevailing Assumption
Journal of Cryptology · 2024-08-19 · 3 citations
Abstract A two-input function is a dual PRF if it is a PRF when keyed by either of its inputs. Dual PRFs are assumed in the design and analysis of numerous primitives and protocols including HMAC, AMAC, TLS 1.3 and MLS. But, not only do we not know whether particular functions on which the assumption is made really are dual PRFs; we do not know if dual PRFs even exist. What if the goal is impossible? This paper addresses this with a foundational treatment of dual PRFs, giving constructions based on standard assumptions. This provides what we call a generic validation of the dual PRF assumption. Our approach is to introduce and construct symmetric PRFs, which imply dual PRFs and may be of independent interest. We give a general construction of a symmetric PRF based on a function having a weak form of collision resistance coupled with a leakage hardcore function, a strengthening of the usual notion of hardcore functions we introduce. We instantiate this general construction in two ways to obtain two specific symmetric and dual PRFs, the first assuming any collision-resistant hash function and the second assuming any one-way permutation. A construction based on any one-way function evades us and is left as an intriguing open problem.
Delegatable Anonymous Credentials from Mercurial Signatures with Stronger Privacy
Lecture notes in computer science · 2024-12-10 · 3 citations
Sarah Meiklejohn