Research engineer F/M – Applied cryptography, distributed systems and zero-knowledge

Research engineer – Applied cryptography, distributed systems and zero-knowledge Download job offer in PDF format Contract type : Fixed-term contract Renewable contract : Yes Level of qualifications required : Graduate degree or equivalent Fonction : Temporary scientific engineer Context This research engineer position is part of the European IPCEI-CIS project (Important Project of Common European Interest – Next Generation Cloud Infrastructure and Services), within the DXP (Data Exchange Platform) project, carried out in collaboration with Amadeus and three Inria research teams: LORELEY, CEDAR and MAGELLAN. The DXP project aims to design and develop an open-source solution for managing a federated and distributed data exchange platform, operating in an open, scalable and massively distributed environment across the entire cloud-edge continuum. In this context, the successful candidate will join the LORELEY project team at the Inria Centre of the University of Lorraine, in Nancy. They will work in an environment at the interface between academic research and software development, interacting with researchers, engineers and industrial partners. The Inria Centre of the University of Lorraine is one of Inria's nine centres and comprises twenty project teams distributed across Nancy, Strasbourg and Saarbrücken. Its activities involve more than 400 people, including scientists and research and innovation support staff, representing 45 different nationalities. The Inria Centre is a major and recognised player in the field of digital sciences. It is located at the heart of a rich research, development and innovation ecosystem, comprising in particular highly innovative small and medium-sized enterprises, large industrial groups, competitiveness clusters, research and higher education institutions, laboratories of excellence and technological research institutes. This position offers the opportunity to work on a topic at the crossroads of applied cryptography, distributed systems, privacy protection and zero-knowledge technologies, with the aim of implementing and evaluating an open-source prototype. Assignment End-to-end encryption (E2EE) systems must be able to authenticate users' public keys in order to protect against man-in-the-middle attacks. Existing solutions rely, in particular, on out-of-band channels [1], shared passwords [2], or centralised key distribution servers. These approaches have significant limitations in terms of usability, decentralisation and privacy protection. Indeed, implementing an out-of-band channel that is both secure and intuitive in practice is challenging. Users often neglect password entropy, while comparing fingerprints is error-prone and time-consuming [3]. On the other hand, relying on a centralised trusted authority to distribute and authenticate public keys greatly simplifies the use and implementation of these systems. However, this centralisation introduces a single point of trust and failure, and may facilitate the collection or monitoring of associations between identifiers and public keys. Consequently, achieving secure and intuitive client authentication remains a major challenge for E2EE systems. The objective of this position is to implement and evaluate a decentralised public key infrastructure that enables the authenticity of public keys to be verified while limiting the information exposed about users and their keys. The solution under investigation will rely on zero-knowledge cryptographic techniques as well as on Key Transparency mechanisms, which aims for users to be able to verify that the public keys associated with them have not been modified or replaced without their knowledge. It must mitigate the risk of man-in-the-middle attacks while limiting the possibilities for user enumeration and the automated collection of the directory mapping identifiers to public keys. [1] Zimmermann, P.R.: The official PGP user’s guide. MIT press (1995) [2] Boyko, V., MacKenzie, P., Patel, S.: Provably secure password-authenticated key exchange using diffie-hellman. In: Advances in Cryptology- Eurocrypt 2000. pp. 156–171. Springer (2000) [3] Whitten, A., Tygar, J.D.: Why johnny can’t encrypt: A usability evaluation of pgp 5.0. In: USENIX Security Symposium. vol. 348 (1999) Main activities • Developing an end-to-end proof of concept for the distributed system. • Integrating the various cryptographic primitives used by the system, including accumulators, commitments, signatures, SNARKs and hash functions. • Integrating existing cryptographic libraries and combining their components to build the cryptographic constructions required by the system, including accumulators, commitments, signatures, SNARKs and hash functions. • Conducting experiments to evaluate the performance, resource consumption and scalability of the solution. • Contributing to the documentation and open-source publication of the work. The position involves close collaboration with researchers from the Inria teams involved in the project. The engineer will contribute to implementation decisions and propose technical optimisations, while building on the scientific and cryptographic choices established as part of the research. Skills Essential Skills: • Experience in software development using at least one of the following programming languages: C++, Rust, Go or Python. • Good knowledge of software design, testing and debugging. • A strong interest in applied cryptography, cyber security, distributed systems and/or privacy protection. • Ability to work on complex technical problems and read scientific literature in English. • A Master's degree or equivalent qualification in computer science or applied mathematics. Desirable Skills: • Proficiency in Rust. • Experience in developing open-source software. • Experience with zero-knowledge frameworks and SNARKs (arkworks, Circom, gnark, etc.). • Experience with distributed systems and/or peer-to-peer networks (libp2p, etc). Benefits package • Subsidized meals • Partial reimbursement of public transport costs • Leave: 7 weeks of annual leave + 10 extra days off due to RTT (statutory reduction in working hours) + possibility of exceptional leave (sick children, moving home, etc.) • Possibility of teleworking and flexible organization of working hours • Professional equipment available (videoconferencing, loan of computer equipment, etc.) • Social, cultural and sports events and activities • Access to vocational training • Social security coverage Remuneration From €2,692 gross per month, depending on qualifications and experience Apply for this position Share • Facebook • Linkedin • Twitter • Email General Information • Theme/Domain : Distributed Systems and middleware System & Networks (BAP E) • Town/city : Villers-lès-Nancy • Inria Center : Centre Inria de l'Université de Lorraine • Starting date : 2027-03-01 • Duration of contract : 12 months • Deadline to apply : 2026-11-14 Warning : you must enter your e-mail address in order to save your application to Inria. Applications must be submitted online on the Inria website. Processing of applications sent from other channels is not guaranteed. Instruction to apply Defence Security : This position is likely to be situated in a restricted area (ZRR), as defined in Decree No. 2011-1425 relating to the protection of national scientific and technical potential (PPST).Authorisation to enter an area is granted by the director of the unit, following a favourable Ministerial decision, as defined in the decree of 3 July 2012 relating to the PPST. An unfavourable Ministerial decision in respect of a position situated in a ZRR would result in the cancellation of the appointment. Recruitment Policy : As part of its diversity policy, all Inria positions are accessible to people with disabilities. Contacts • Inria Team : LORELEY • Recruiter : Ignat Claudia-lavinia / claudia.ignat@inria.fr The keys to success • Ability to work independently and take the initiative. • An interest in experimentation and solving complex problems. • Ability to work as part of a team with researchers, engineers and industry partners. • Good communication skills in both French and English. About Inria Inria, the French national institute for research in digital science and technology, supports the French government in national research and innovation strategies in the digital field, acting as Digital Programs Agency. Inria leads over 300 research and innovation projects with its 3,500 scientists, engineers, and support staff, in partnership with universities and the digital ecosystem (businesses, entrepreneurs, and public stakeholders). Together, we explore strategic fields such as artificial intelligence, cybersecurity, quantum computing, cloud technologies, digital transformation in healthcare, digital twins, and digital technologies for defence. We develop practical solutions such as software, tech startups, partnerships with national companies, and cutting-edge training programmes. Our goal is to drive scientific, technological, and industrial excellence to ensure France’s digital sovereignty.