
My name is Zach. My pronouns are he/him/his. I’m a senior research engineer at MongoDB Research.
My research vision is to make privacy-preserving systems for data processing and retrieval so efficient, expressive, understandable, and appropriately secure that they become the default choice in many real-world scenarios. My recent work focuses on structural-invariant-based leakage attacks, automated leakage analysis engines, expressive and efficient encrypted data structures, and application-centric cryptographic design to support at-risk communities. To do this, I maintain a broad set of interests in cryptography, formal methods, data structures, computer systems, and human factors.
I completed a concurrent Sc.B. and Sc.M. at Brown University. My studies were generously supported by grants from Brown CS, CrowdStrike, (ISC)2, and the CIT Group. I was also affiliated with the following research groups:
I love teaching, and I particularly love teaching computer security. I was the course designer and Head Teaching Assistant of the Computer Science department’s flagship computer systems security course from 2019 to 2021.
Outside of research, I think about things like long distance running, pottery on the wheel, theatrical lighting design, Broadway theater producing and investing, small-scale immersive theater, tabletop gaming, and Dance Dance Revolution.
I’ll be at Asiacrypt 2025 in Melbourne, Australia!
Our paper “tigro: Trust Infrastructure for Grassroots Organizing via Grounded Digital Annotations” will appear at PETS 2026!
I’m part of the USENIX Security 2026 Artifact Evaluation Committee!
Our paper “Leafblower: A Leakage Attack Against TEE-Based Encrypted Databases” will appear at at IEEE Security & Privacy 2026 in San Francisco, CA!
I’ve joined the inaugural IEEE Security & Privacy 2026 Artifact Evalaution Committee! I’m also part of the PETS 2026 Artifact Evaluation Committee!
Our paper “Structured Encryption and Distribution-aware Leakage Suppression” will appear at Asiacrypt 2025 in Melbourne, Australia!
Our paper “PolySys: an Algebraic Leakage Attack Engine” will appear at the 34th USENIX Security Symposium in Seattle, WA, USA!
Our paper “Bayesian Leakage Analysis” was published in IACR Communications of Cryptography!
Our paper “Sequentially Consistent Concurrent Encrypted Multimaps” will appear at IEEE Euro Security & Privacy 2025 in Venice, Italy!
Range Search is now generally available in MongoDB’s Queryable Encryption!
Our paper “Synq: Public Policy Analytics Over Encrypted Data” will appear at IEEE Security & Privacy 2024 in San Francisco, CA!
Our new product at MongoDB—Queryable Encryption, the first industry database product implementing structured encryption—is now generally available!
I reunited with some of my former collaborators from the Encrypted Systems Lab at Brown University by joining the Cryptography Research Group at MongoDB!
Our paper “Range Search over Encrypted Multi-Attribute Data” will appear at VLDB 2023 in Vancouver, Canada!
Five months after completing my requirements, I “officially” graduated with a Sc.B. in Computer Science (with Honors) and an Sc.M. in Computer Science at Brown University’s annual Commencement.
I was awarded a Senior Prize in Computer Science “for academic work as well as service to Brown CS” (awarded to 6.8% of the graduating class in CS). I also received the Norman K. Meyrowitz ’81 Award for “exceptionally meritorious service to Brown CS” (second to receive the award in the award’s history).
Our paper “Time- and Space- Efficient Aggregate Range Queries on Encrypted Databases” will appear at PETS 2022!
I defended my honors thesis on “Time- and Space- Efficient Aggregate Range Queries on Encrypted Databases” and finished my Bachelor’s and Master’s requirements at Brown!
I received an Crowdstrike NextGen Scholarship for 2021!
Received an (ISC)2 Undergraduate Information Security Scholarship for 2021.
I received the Randy Pausch Undergraduate Research Award from Brown CS to support my research with Roberto Tamassia on encrypted databases!
⁂ denotes authors listed alphabetically. Click abstracts to expand.
A cryptographic primitive for “grounded annotations”, motivated by the needs of activist communication in authoritarian environments. We create an broader protocol using this primitive and implement it in a proof-of-concept application.
Attack against a class of TEE-based encrypted databases. It allows a multi-snapshot external memory adversary (weaker than the traditional, persistent TEE adversaries) to learn the plaintext of INSERT operations on a SQLite database running inside of Gramine. We do this by exploiting B+-tree invariants that are observable just from snapshots of encrypted index files.
New, static, distribution-aware, replication-based leakage suppressors with better performance than existing full suppressors (Kamara et al. (2018); George et al. (2022)) and prior replication-based suppressors (Pancake, Waffle).
Polynomial-system-based theory for modeling leakage profiles and automatically evaluating their security in provably optimal ways via SAT solvers.
Bayesian-network-based theory for modeling leakage profiles and mathematically evaluating their security in provably optimal ways. We also come up with a new network inference algorithm that efficiently handles the types of “leakage networks” commonly seen in encrypted search.
New definitions, schemes, and implementations for encrypted multimaps that are sequentially consistent, a consistency model that closely resembles the transactional guarantees of common real-world databases.
In collaboration with Brown’s Policy Lab, a system for encrypted, multi-party, data analytics specifically designed to support a government-mandated study run by the Massachusetts’s Department of Public Health on the opioid epidemic.
New schemes for encrypted, multi-dimensional range search.
Algorithmic leakage attacks against encrypted, response-hiding, multi-dimensional range search schemes. We use data structural, invariant-based reasoning to demonstrate how to fully recover the plaintext of queries (and thus, the indexed values).
New schemes for encrypted, aggregate range queries. (This was also my undergraduate honors thesis.)
I served as a teaching assistant every semester I was at Brown University, sometimes even during semesters I wasn't enrolled. ⁂ denotes a Head Teaching Assistant role.
Software exploitation techniques and state-of-the-art mechanisms for hardening software. With Vasileios Kemerlis.
An introduction to principles of computer security from an applied viewpoint and provides hands-on experience on security threats and countermeasures. Topics include cryptosystems, web security, network security, malware, code execution vulnerabilities, access control, cryptocurrencies, machine learning, and human and social issues. With Roberto Tamassia (2019, 2020) and Bernardo Palazzi (2021).
Explores the principles of modern programming languages by implementation; studies data and their types, including polymorphism, type inference, and type soundness; examines compiler and run-time system topics: continuation-passing style and garbage collection. With Shriram Krishnamurthi.
Functional programming, data structures, and algorithms in Racket and Pyret. Includes a summer component taught using the first half of How to Design Programs, then transitions to content based on portions of Programming and Programming Languages during the semester. With Shriram Krishnamurthi.
Introduction to programming in MATLAB and Python, with an emphasis on STEM data analysis and simulation problems. With Dan Potter.
Data-focused introduction to computer science using Pyret. With Kathi Fisler.