my photo

Merry Ember Mou

I am a security software engineer specializing in applied cryptography, security, and privacy-respecting systems. I develop usable security and applied cryptography for production from protocol design to server-side deployment.

I currently work at Zoom, where I’m implementing end-to-end encryption (E2EE) for Zoom products, including video meetings. I've been building a privacy-preserving key transparency tree to support auditable user identity, for which we’ve formalized the security properties of its underlying zero-knowledge cryptography primitives. I've also led the design and implementation of features such as third-party attestations of users’ cryptographic keys. Additionally I am a maintainer of the Zoom Cryptography Whitepaper, and have spoken at conferences about our work.

Previously, I worked on Keybase, building a E2EE platform on top of the first auditable public key directory deployed in production. Before that, I built global internet scanning data collection pipelines at the network security company Expanse, Inc.. During my masters, I contributed to CivilServant (now the Cornell Citizens and Technology (CAT) Lab), a platform that enables large-scale online citizen science. I completed my computer science undergrad and masters at MIT with the MIT Internet Policy Research Initiative.

Papers

J. Blum, S. Booth, O. Gal, M. Krohn, J. Len, K. Lyons, A. Marcedone, M. Maxim, M. E. Mou, J. O’Connor, et al. Zoom Cryptography Whitepaper. 2022.

B. Chen, Y. Dodis, E. Ghosh, E. Goldin, B. Kesavan, A. Marcedone, & M. E. Mou. Rotatable Zero Knowledge Sets : Post Compromise Secure Auditable Dictionaries with Application to Key Transparency. In Advances in Cryptology - ASIACRYPT 2022, Cham, 2022. Springer International Publishing.

Matias, J. N., Mou, M. E., Penney, J., & Klein, M. (2020). Do Automated Legal Threats Reduce Freedom of Expression Online? Preliminary Results from a Natural Experiment.

Matias, J. N., & Mou, M. (2018, April). CivilServant: Community-Led Experiments in Platform Governance. In Proceedings of the 2018 CHI Conference on Human Factors in Computing Systems (p. 9). ACM.

Experience

Zoom Video Communications

Senior Security Software Engineer • May 2020 — Present

Designing and building infrastructure for end-to-end encryption.

  • Zoom Transparency Tree Designing and deploying a privacy-preserving public key directory system that supports auditability of user E2EE identity. Partnering with infrastructure and product engineering teams to ensure and improve user security across Zoom features.
  • Zoom Cryptography Whitepaper Documenting the security and privacy properties of cryptographic designs powering Zoom products in a continually updated, public whitepaper, since its initial release in May 2020.
  • Okta Authentication for End-to-End Encryption (E2EE) Led technical design and development to support third-party attestations of users’ cryptographic keys in E2EE video meetings. Drove implementation across ~10 teams spanning engineering, product, marketing, legal, and external partners.

Keybase

Software Engineer • Oct 2019 — May 2020

Worked on an encrypted chat platform, projects including team-encrypted key-value stores and Keybase-backed SSH CA.

Expanse, Inc.

Software Engineer • Sep 2017 — Jul 2019

Developed functionality for a Internet asset discovery platform on a range of back-end projects, including network scanning infrastructure, ETL pipelines, microservice deployments, and internal tool full-stack development.

  • Contextual IPv4 Scanning Led project investigation and system implementation to improve global IPv4 scan accuracy and efficiency.

CivilServant, MIT Center for Civic Media

Software Engineer, Researcher • May 2016 — Sep 2017, July 2019 — Sep 2019

Built and evaluated software infrastructure that facilitates large-scale participatory experimentation of online moderation policies.

MIT Internet Policy Research Initiative

Researcher • Feb 2016 — May 2017

Implemented tools for network speed measurement.

Projects

  • vrf-r255 Validated and produced test vectors for the Community Cryptography Specification Project (C2SP) vrf-r255 spec of the Verifiable Random Function (VRF) cryptographic primitive using ristretto255.
  • threshold-OPAQUE Experimental Rust implementation of OPAQUE protocol, an asymmetric PAKE, and of threshold OPAQUE (supports multiple servers).
  • TOTP client Keybase chat bot
  • cyberpunk LED marquee Holzer-esque LED marquee, controlled via Rust code running on a raspberry pi. Built for a cyberpunk-themed music festival stage, now perpetually scrolling dystopian gibberish at home.

Talks

Education

Massachusetts Institute of Technology (MIT)

  • Master of Engineering in Computer Science. GPA 5.0. 2016 — 2017.
  • B.S. in Computer Science. GPA 4.8. 2012 — 2016.