Chenzhi Zhu

I was a Postdoctoral Fellow at the CIS Lab at NTT Research, hosted by Elette Boyle. I received my Ph.D. in the Paul G. Allen School of Computer Science & Engineering at the University of Washington, where I was fortunate to be advised by Stefano Tessaro.

Prior to this, I received my bachelor’s degree from Yao Class at Tsinghua University. I did an internship at Microsoft Research during the summer of 2024, working with Esha Ghosh and Melissa Chase. I also did an internship at NTT CIS lab during the summer of 2023, working with Ilan Komargodski. I was visiting CMU during 2019, working under the supervision of Vipul Goyal on cryptography.

I have a broad interest in cryptography and related fields of theoretical computer science. I love solving concrete, discrete problems. My focuses include designing concretely efficient privacy preserving protocols, threshold cryptographic protocols, and post-quantum secure protocols.

Research highlights

Lattice-based threshold signatures	Our results [ZT25] impacted the Tanuki and Hermine submissions to the NIST threshold call, where they both rely on our work to establish security under the standard assumptions. More details In [CATZ24], we developed the first partially non-interactive (1 offline + 1 online round) lattice-based threshold signatures under the standard assumptions (MSIS and MLWE) without FHE. Concurrent to our work, Espitau et al. [EKT24] proposed a more efficient partially non-interactive construction (corresponding to Tanuki) but based on a non-standard assumption, algebraic one-more MLWE (AOM-MLWE). Our follow-up work [ZT25] shows that AOM-MLWE can be reduced to the standard assumptions. Our results inspired the follow-up work, Hermine [BCdP+26], which additionally supports efficent identifiable abort.
Security ananlysis of FROST	Our security analysis of FROST [BCK+22] directly influenced the FROST RFC, which revised the specification from FROST2 back to the original FROST based on our demonstrated security separation. Moreover, our security hierarchy and analysis, covering both static and adaptive security [CKK+25], now form a core part of the ongoing FROST submission to the NIST threshold call. More details FROST [KG20] is the state-of-the-art threshold Schnorr signature scheme that supports partially non-interactive signing and identifiable abort. In [BCK+22], we presented the first formal security analysis of FROST and show that it achieves stronger security guarantees than those captured by prior definitions. Concretely, we introduced a new security hierarchy for partially non-interactive threshold signature schemes and showed that FROST achieves the third level in this hierarchy. We further analyzed FROST2 [CKM21], a slightly more efficient variant of FROST, and proved that they achieve only the second (weaker) level of security. Our follow-up work [CKK+25] further established the adaptive security of FROST under the AOMDL [NSF20] assumption and hardness of a new computational problem, called the low-dimensional vector representation (LDVR) problem, and showed this reliance on LDVR hardness is necessary. We further proved unconditional hardness of LDVR for various settings of threshold and signer set size.
Security analysis of BBS signatures	This work [TZ23] had a direct impact on the RFC draft for BBS signatures, which changed the specification from BBS+ to the original BBS signature and adopted our newly proposed proof-of-knowledge protocols. More details BBS signatures [BBS04] are among the most efficient pairing-based signature schemes and are particularly well suited for applications such as anonymous credentials and direct anonymous attestation, with ongoing standardization efforts at W3C and IETF. However, prior work provided security proofs only for a slightly less efficient variant, BBS+ [ASM08], which adds an extra scalar to the signature relative to the original BBS construction. In [TZ23], we showed that the original BBS signature in fact achieves the same security guarantees as BBS+, and we further developed simplified proof-of-knowledge protocols for BBS signatures. Our work has also inspired and influenced several follow-up works on BBS signatures [CAT25, CAHT25] and BBS-based anonymous credential systems [FLL24, DDKT25].