Hi! I'm a cryptography researcher in the ENCRYPTO group at TU Darmstadt, supervised by Thomas Schneider. My research is about secure multiparty computation (MPC), where I mainly focus on the design of practical, multi-purpose MPC protocols and building blocks for them. I am also interested in specific applications of MPC such as graph analysis and in the societal impact, opportunities and consequences of deploying privacy-enhancing technologies.
| Pronouns: | they/them (German: dey/denen/deren) | |
| Email: | brueggemann@encrypto.cs.tu-darmstadt.de |
Many linear secret-sharing schemes like replicated sharing, Shamir's sharing, and masked sharing (as in ABY2.0 etc.) enable non-interactive multiplication into some intermediate sharing, and MPC protocols usually follow this up by some interaction to go back to the prior secret sharing domain. We asked ourselves: Why only use the second domain as an intermediate step (and optimize the ocasional dot product)? We instead view the presence of two domains as a starting point for some kind of hybrid MPC, enabling to have inputs, outputs, and linear operations in both domains as a generic way to accelerate existing MPC protocols, we propose an automated optimizer, and we also generalize the notion of masked secret sharing as known from works like ABY2.0.
Distributed zero-knowledge proofs (DZKPs) can allow to extend passively secure MPC protocols to active security at a communication overhead that is sublinear in the circuit size. Most protocols using DZKPs are in the honest majority setting, including DZKPs natively supporting computation on rings Z2k. For the dishonest majority with a trusted dealer or (n+1)-setting, DZKPs can be used too, but at a significant concrete overhead when computing on Z2k. We introduced native Z2k DZK to the (n+1)-setting, also utilizing additional novel optimizations. Most centrally, while prior works use one DZKP per party to let each party prove that it behaved correctly, we provide one proof to rule them all, verifying that all parties collectively behave correctly in one single DZKP. Using that, for the first time, MPC based on DZKPs scales well with the number of parties.
Preprocessing in MPC protocols is often categorized as function-independent or function-dependent, with the latter often refering to protocols such as ABY2.0 based on masked secret sharing. Yet, this greatly oversimplifies things. There is a whole spectrum of how strong function dependence is, and there are vastly different kinds of function dependence. Works claiming to be function-independent still often hide some kind of function dependence, while such denoted function-dependent can still maintain some flexibility. We looked at different kinds of preprocessing in the literature, tried to categorize them, and looked into multiple practical implications of function dependence.
We identified severe flaws in the MPC protocols Trident (NDSS'20), Fantastic Four (USENIX Security'21), SWIFT (USENIX Security'21), and Quad (PoPETS'25), enabling to extract private information. These flaws resulted in vulnerabilities in the MPC frameworks MP-SPDZ, HPMPC, and ORQ. Our attack is enabled by the fact that all affected protocols delay their redundancy-based cheater detection to the end of the protocol execution to increase their performance. We show how a cheater can carefully exploit the time until the end of the protocol when it gets caught to extract private information, using the very same cheater detection. We proposed a low-overhead fix and coordinated the deployment of fixes with the maintainers of the affected MPC frameworks.
We researched the use of message-passing graph algorithms for scalable privacy-enhancing graph analysis, improving the general framework over the prior state of the art Graphiti, adding support for multi(layer) graphs, providing solutions for privately computing centrality measures, and we provide an open-source implementation and later also a user-friendly framework able to analyze graphs with sizes in the millions.
In 2024, the German Self-Determination Act (SBGG) was passed, intended to improve legislation regarding transidentity. Justified by a fear of name changes being exploited to avoid prosecution, the law almost got extended by a section requiring all information regarding name changes to be transmitted to ten different law enforcement agencies, some of them being known to maliciously collect information on queer individuals in the past. In an interdisciplinary research involving law and cryptography, we investigated legal, technical, and further risks, and we investigated how private set intersection (PSI), which has been ignored in the lawmaking process, could have mitigated some risks while leaving others open.
While MPC research usually considers symmetric models where either a passive or an active adversary can corrupt any subset of parties (up to some size), the real world often is more complex and different parties may be trusted to different degrees. We looked at the three-party honest-majority case where only once fixed party can be corrupted actively, while others are trusted to follow the protocol. This opens up a spectrum between the symmetrical passive and active adversary cases, where we propose two new protocols that can be instantiated with different techniques for active security, i.e., triple sacrificing, cut and choose, and zk-FLIOPs, which we adapt and optimize for the now asymmetric case.
We combined two mechanisms of ABY2.0, the efficient computation of dot products and the efficient computation of multi fan-in AND gates, to build a new subprotocol for secure lookup table (LUT) evaluation with high online performance. We also demonstrated efficient offline instantiation using Silent OT and updated prior LUT protocols to also support Silent OT, establishing our new protocol to provide the best offline-online-tradeoff.
We utilized efficient matrix multiplication in function-dependent preprocessing and permutation matrices to construct novel shuffling protocols for passively and actively secure MPC.
We investigated using a simple approximation for the maximum weight matching problem to achieve scalability when computing matchings in MPC. This work is based on my master's thesis about applying such algorithm for privacy-preserving kidney exchange in MPC, where medically incompatible patient-donor-pairs for kidney transplantation are matched to other incompatible pairs where a crosswise exchange still may be possible.