Hey, I'm Ruben!
I'm a PhD student at the Chair of Applied Cryptography at Friedrich-Alexander-University Erlangen-Nürnberg, in Erlangen, Germany, supervised by Dominique Schröder. You can reach me at mail [at] ruben-baecker.de, find me on Google Scholar and DBLP, or download my CV as a PDF.
If you're reviewing an application of mine, feel free to switch to "formal" mode in the top right corner ;)
Ruben Baecker
PhD student
Chair of Applied Cryptography
Friedrich-Alexander-University Erlangen-Nürnberg
Erlangen, Germany
mail [at] ruben-baecker.de
Google Scholar ·
DBLP ·
CV (PDF)
Research
I build cryptographic protocols that decentralize trust. No single party holds the key, and no single corruption breaks the system. A second line of work builds cryptography from secrets as weak as a password.
Threshold cryptography
In threshold cryptography, a key is protected by requiring t parties to collaborate, but securing protocols against adaptive corruptions, where the attacker picks targets while watching the protocol run, often demands heavy assumptions. My research builds adaptively secure protocols under reduced assumptions, including Threshold Schnorr Signatures [BGLRSY26], Distributed Key Generation [BGJNRS26], and Oblivious PRFs [BGRS25].
Password-based cryptography
In password-based cryptography, systems are secured despite predictable, human-generated secrets. The core challenge is preventing offline cracking by forcing attackers into rate-limited online guessing. My papers identify gaps in prior works and propose stronger security models and protocols to close them [BGS25][ABGGKRS25].
Three of my papers are proved within the Universal Composability framework [ABGGKRS25][BGRS25][BGJNRS26], and three are proved using Game-based definitions [BGS25][BGLRSY26][BGKS26].
How I came to crypto Back to the short version
How I came to crypto
I've been fascinated by cryptography since I was a kid, drawing up my own ciphers in elementary school and hiding secret alphabets in empty pen cartridges. My first real Java program was an encryption scheme built on multi-alphabet substitution. As a high school student, I attended two seminars at Fraunhofer, one on cryptography and one on embedded hardware. After the second, we started to design a custom encryption machine in hardware, but unfortunately never finished.
Then I read a book on cryptography and concluded the field was finished. We had symmetric encryption, public key encryption and signatures, so what else could there be? Turns out: a lot. Once I started studying computer science I took every crypto lecture I could find, and I haven't really stopped since.
Research
I design cryptographic protocols that decentralize trust. No single party holds the key, and no single corruption breaks the system. A second line of work builds cryptography from low-entropy secrets, in practice passwords.
Threshold cryptography
In threshold cryptography, a key is protected by requiring t parties to collaborate, but securing protocols against adaptive corruptions, where the attacker picks targets while watching the protocol run, often demands heavy assumptions. My research constructs adaptively secure protocols under reduced assumptions, including Threshold Schnorr Signatures [BGLRSY26], Distributed Key Generation [BGJNRS26], and Oblivious PRFs [BGRS25].
Password-based cryptography
In password-based cryptography, systems remain secure despite low-entropy, human-chosen secrets. The central challenge is preventing offline cracking by forcing an adversary into rate-limited online guessing. My papers identify gaps in prior works and propose stronger security models and protocols to close them [BGS25][ABGGKRS25].
Three of my papers are proved within the Universal Composability framework [ABGGKRS25][BGRS25][BGJNRS26], and three are proved using Game-based definitions [BGS25][BGLRSY26][BGKS26].
Recent Publications
Abstract
Abstract
A Decentralized Autonomous Organization (DAO) enables multiple parties to collectively manage digital assets in a blockchain setting. We focus on achieving fair exchange between DAOs using a cryptographic mechanism that operates with minimal blockchain assumptions and, crucially, does not rely on smart contracts.
Specifically, we consider a setting where a DAO consisting of n_S sellers holding shares of a witness w interacts with a DAO comprising n_B buyers holding shares of a signing key sk; the goal is for the sellers to exchange w for a signature under sk transferring a predetermined amount of funds.
Fairness is required to hold both between DAOs (i.e., ensuring that each DAO receives its asset if and only if the other does) as well as within each DAO (i.e., ensuring that all members of a DAO receive their asset if and only if every other member does).
We formalize these fairness properties and present an efficient protocol for DAO-based fair exchange under standard cryptographic assumptions. Our protocol leverages certified witness encryption and threshold adaptor signatures, two primitives of independent interest that we introduce and show how to construct efficiently.
Abstract
Passwords remain the dominant form of authentication on the Internet. The rise of single sign-on (SSO) services has centralized password storage, increasing the devastating impact of potential attacks and underscoring the need for secure storage mechanisms. A decade ago, Facebook introduced a novel approach to password security, later formalized in Pythia by Everspaugh et al. (USENIX'15), which proposed the concept of password hardening. The primary motivation behind these advances is to achieve provable security against offline brute-force attacks. This work initiated significant follow-on research (CCS'16, USENIX'17), including Password-Hardened Encryption (PHE) (USENIX'18, CCS'20), which was introduced shortly thereafter. Virgil Security commercializes PHE as a software-as-a-service solution and integrates it into its messenger platform to enhance security.
In this paper, we revisit PHE and provide both negative and positive contributions. First, we identify a critical weakness in the original design and present a practical cryptographic attack that enables offline brute-force attacks – the very threat PHE was designed to mitigate. This weakness stems from a flawed security model that fails to account for real-world attack scenarios and the interaction of security properties with key rotation, a mechanism designed to enhance security by periodically updating keys. Our analysis shows how the independent treatment of security properties in the original model leaves PHE vulnerable. We demonstrate the feasibility of the attack by extracting passwords in seconds that were secured by the commercialized but open-source PHE provided by Virgil Security.
On the positive side, we propose a novel, highly efficient construction that addresses these shortcomings, resulting in the first practical PHE scheme that achieves security in a realistic setting. We introduce a refined security model that accurately captures the challenges of practical deployments, and prove that our construction meets these requirements. Finally, we provide a comprehensive evaluation of the proposed scheme, demonstrating its robustness and performance.
Show all papers Show fewer
Abstract
Password-Hardened Encryption (PHE) protects against offline brute-force attacks by involving an external ratelimiter that enforces rate-limited decryption without learning passwords or keys. Threshold Password-Hardened Encryption (TPHE), introduced by Brost et al. (CCS’20), distributes this trust among multiple ratelimiters. Despite its promise, the security foundations of TPHE remain unclear. We make three contributions:
- We uncover a flaw in the proof of Brost et al.’s TPHE scheme, which invalidates its claimed security and leaves the guarantees of existing constructions uncertain;
- We provide the first universal composability (UC) formalization of PHE and TPHE, unifying previous fragmented models and supporting key rotation, an essential feature for long-term security and related primitives such as updatable encryption;
- We present the first provably secure TPHE scheme, which is both round-optimal and UC-secure, thus composable in real-world settings; and we implement and evaluate our protocol, demonstrating practical efficiency that outperforms prior work in realistic WAN scenarios.
Abstract
Oblivious Pseudorandom Functions (OPRFs) are fundamental cryptographic primitives essential for privacy-enhancing technologies such as private set intersection, oblivious keyword search, and password-based authentication protocols. We present the first fully adaptive, partially oblivious threshold pseudorandom function that supports proactive key refresh and provides composable security under the One-More Gap Diffie-Hellman assumption in the random oracle model.
Our construction is secure with respect to a new ideal functionality for OPRFs that addresses three critical shortcomings of previous models–specifically, key refresh and non-verifiability issues that rendered them unrealizable. In addition, we identify a gap in a prior work’s proof of partial obliviousness and develop a novel proof technique to salvage their scheme.
Preprints
Abstract
The security of decentralized asset custody and blockchain consensus increasingly relies on threshold signatures to eliminate single points of failure. In these high-stakes environments, static security models are an insufficient theoretical abstraction. Real-world blockchain deployments demand adaptive security to ensure protocols remain secure against adversaries who reactively compromise participants based on observed network traffic and protocol state.
While the NIST standardization effort and Bitcoin’s Taproot (BIP340) upgrade have accelerated interest in adaptively secure threshold Schnorr signatures, a threshold system is only as secure as its setup phase. In decentralized settings, this necessitates a Distributed Key Generation (DKG) protocol to eliminate reliance on a trusted dealer. However, a critical gap remains: current DKG protocols are incompatible with the specific key structures required by promising schemes (EUROCRYPT'26). Furthermore, a result from CRYPTO'25 demonstrated that unique key commitments necessitate a non-falsifiable assumption for adaptive security. To avoid non-standard assumptions, DKG protocols must be key-share hiding, a property existing DKGs fail to provide.
We close this gap by proposing two novel DKG protocols that support identifiable abort and tolerate a dishonest majority and prove them secure under new ideal functionalities in the UC framework. Our first protocol achieves optimal round complexity via a single broadcast round at the cost of allowing adversarial bias, while our second protocol eliminates the bias in two rounds. In addition, the protocols provide a proactive key refresh mechanism that allows long-lived decentralized networks to refresh internal key material periodically. This enables the system to recover from transient node compromises without the operational burden of rotating the underlying public key. Our evaluation demonstrates that these constructions are practically efficient, incurring minimal communication and computation overhead for modern high-throughput architectures.