Ethan Heilman

Main || Writing || CV (PDF) || CV (Markdown)

Ethan Heilman (Ph.D)October 18, 2026 CryptologistEthan.R.Heilman@gmail.com https://github.com/EthanHeilmanhttps://www.ethanheilman.com/

Education

Research Areas

As a Network Security researcher I investigate the security of Bitcoin, blockchains and other deployed global scale networks. My work employs tools from system-building, measurement, modeling and simulation, network security and cryptology.

Employment

Recent Awards, Grants & Honors

Publications

  1. 2024 ColliderScript: Covenants in Bitcoin via 160-bit hash collisions, E. Heilman, V. Kolobov, A. Levy, A. Poelstra
  2. 2023 OpenPubkey: Augmenting OpenID Connect with User-held Signing Keys, E. Heilman, L. Mugnier, A. Filippidis, S. Goldberg, S. Lipman, Y. Marcus, M. Milano, S. Premkumar, C. Unrein
  3. 2020 Cryptanalysis of Curl-P and other attacks on the IOTA cryptocurrency, IACR Transactions on Symmetric Cryptology 2020, E. Heilman, N. Narula, G. Tanzer, J. Lovejoy, M. Colavita, M. Virza, T. Dryja
  4. 2020 The Arwen Trading Protocols, International Conference on Financial Cryptography and Data Security 2020, E. Heilman, S. Lipmann, S. Goldberg
  5. 2018 Low-Resource Eclipse Attacks on Ethereum's Peer-to-Peer Network, Y. Marcus, E. Heilman, S. Goldberg
  6. 2018 The rewards of selfish mining: technical perspective, Communications of the ACM, S. Goldberg, E. Heilman
  7. 2018 An Empirical Analysis of Traceability in the Monero Blockchain, Proceedings on Privacy Enhancing Technologies, M. Möser, K. Soska, E. Heilman, K. Lee, H. Heffan, S. Srivastava, K. Hogan, J. Hennessey, A. Miller, A. Narayanan, N. Christin
  8. 2017 Atomically trading with roger: Gambling on the success of a hardfork, International Workshop on Data Privacy Management Cryptocurrencies and Blockchain Technology, P. McCorry, E. Heilman, A. Miller
  9. 2017 TumbleBit: An Untrusted Bitcoin-Compatible Anonymous Payment Hub, Network and Distributed System Security Symposium (NDSS 2017), E. Heilman, L. Alshenibr, F. Baldimtsi, A. Scafuro, S. Goldberg
  10. 2016 Blindly Signed Contracts: Anonymous On-Blockchain and Off-Blockchain Bitcoin Transactions, 3rd Workshop on Bitcoin and Blockchain Research at 20th International Conference of Financial Cryptography, E. Heilman, F. Baldimtsi, S. Goldberg
  11. 2015 Eclipse Attacks on Bitcoin's Peer-to-Peer Network, USENIX Security'15, E. Heilman, A. Kendler, A. Zohar, S. Goldberg
  12. 2014 From the Consent of the Routed: Improving the Transparency of the RPKI, SIGCOMM'14, E. Heilman, D. Cooper, L. Reyzin and S. Goldberg
  13. 2014 One Weird Trick to Stop Selfish Miners: Fresh Bitcoins, A Solution for the Honest Miner, E. Heilman, Poster at FC'14
  14. 2013 On the risk of misbehaving RPKI authorities, Proceedings of the Twelfth ACM Workshop on Hot Topics in Networks, D. Cooper, E. Heilman, K. Brogle, L. Reyzin, S. Goldberg
  15. 2011 Restoring the Differential Resistance of MD6, ECRYPT II Hash Workshop, E. Heilman
  16. 2009 Attacks Against Permute-Transform-Xor Compression Functions and Spectral Hash Collisions, NIST mailing list, Cryptology ePrint Archive Report, E. Heilman
  17. 2007 Poster: Developing low-cost AVL and Web Mapping for Real Time Intermodal Customer Information Using a GPS Cell Phones and Google Maps, U. Shama, L. Harman, E. Heilman, J. Baltikauskas
  18. 2006 Metrowest Suburban Mobility Research, Development and Technology Project, Office of Transportation Planning, Executive Office Of Transportation, Draft., E. Heilman, U. Shama and L. Harman

Selected Presentations

  1. OpenPubkey: Augmenting OpenID Connect with User held Signing Keys
    • Cloudflare Research, Remote, 2024
    • Cloudflare Eng Presents, Remote, 2024
    • BSides Cambridge, Belmont, Massachusetts, 2023
  2. OP_CAT
    • OP NEXT, Fidelity Center for Applied Technology (FCAT), Boston, Massachusetts, 2024
    • MIT Media Lab Digital Currency Initiative (Research Talk), Cambridge, Massachusetts, 2024
  3. Signing Docker Official Images Using OpenPubkey (youtube)
    • DockerCon, Los Angeles, California, 2023
  4. An Exploration of Bitcoin's P2P Network and its Security
    • Bitcoin Research Day, New York, New York, 2023
  5. Cryptanalysis of Curl-P and Other Attacks on the IOTA Cryptocurrency
    • 27th annual Fast Software Encryption conference (remote), Athens, Greece, 2020
    • BlackHat USA, Las Vegas, 2018
    • Boston Blockchain Network, Boston, 2017
  6. Near Misses: What Could've Gone Wrong
    • Cryptoeconomic Systems Summit, Cambridge, MA, 2019
  7. Bitcoin Eclipse Attacks (Survey)
    • Chaincode Labs, New York, 2018
  8. xCrow Protocol for Fast Crosschain Atomic Swaps
    • Binary District “Off the chain” workshop, Berlin, 2018
  9. Cross-Chain Swaps
    • Dev++ Bitcoin Edge/BC-2, Keio University, Japan, 2018
    • Dev++ Bitcoin Edge, Stanford University, 2017
    • BC-2, Tokyo, 2017
  10. Atomically trading with roger: Gambling on the success of a hardfork
    • Scaling Bitcoin, Stanford, 2017
  11. TumbleBit: An Untrusted Bitcoin-Compatible Anonymous Payment Hub
    • NDSS'17: The Network and Distributed System Security Symposium (2017)
    • The New Context Conference, San Francisco (2016)
    • The Scaling Bitcoin Workshop, Milan (2016)
    • University of Illinois, Urbana-Champaign (2016)
    • MIT Media Lab Digital Currency Initiative Blockchain Seminar (2016)
    • MACS Project Meeting (2016)
    • MIT Security Seminar (2016)
  12. Blindly Signed Contracts: Anonymous On-Blockchain and Off-Blockchain Bitcoin Transactions
    • BITCOIN'16 (2016)
    • Cornell Systems Lunch (2016)
    • MIT Security Seminar (2016)
  13. Eclipse Attacks on Bitcoin's Peer-to-Peer Network
    • USENIX Security'15 (2015)
    • UMass, Amherst (2015 and 2016)
    • UPenn Seminar (2015)
    • Princeton Bitcoin Workshop (2015)
    • University of Maryland Syschat (2015)
    • MIT Security Seminar (2015)
  14. From the Consent of the Routed: Improving the Transparency of the RPKI
    • SIGCOMM'14 (2014)
    • New England Networking and Systems Day (2014)
    • Boston University Security Seminar (2014)
    • Hubspot Tech Talks (2014)
  15. Restoring the Differential Security of MD6
    • ECRYPT II Hash Workshop, Estonia (2011)
    • MIT Crypto Group (2011)
  16. Developing low-cost AVL and Web Mapping for Real Time Intermodal Customer Information Using a GPS Cell Phones and Google Maps
    • Transportation Research Symposium Institute of Transportation Engineers Massachusetts Chapter (MAITE) (2007)
    • 23rd National Conference on Undergraduate Research (2007)

Teaching Assistant (Boston University)

Academic Service

Program Chair

Session Chair

Program Committee

External Reviewer

Selected Open Source Software Projects

  1. OpenPubkey: An implementation in go-lang of the OpenPubkey protocol. Currently a project under the Linux Foundation. This project is based on an implementation of OpenPubkey I wrote. I am currently the main contributor and chair of the technical steering committee.
  2. Bitcoin Peer Forger (BPF): BPF is a network security research tool which allows an on-path party to connect to a Bitcoin node from a large number of spoofed IP addresses.
  3. TumbleBit: Implements TumbleBit protocol as part of TumbleBit research publication. Used as a reference for development of nTumbleBit open source project.
  4. RPKI Downgrade Detector: RPKI transparency tool released as part of RPKI and secure routing publications. Used at NIST for RPKI anomaly detection.
  5. Flip It: Javascript implementation of a research game designed to model Advanced Persistent Threats (APT). While not developed for this purpose, a research team had people play my implementation of Flip It to explore the psychology of computer security.
  6. Differential Pattern Search Program for MD6: This software is used to reestablish the differential resistance of MD6. It uses a classification system of differential weight patterns that allows us to extend previous analysis to prove that MD6 is resistant to differential cryptanalysis.
  7. Contributions to bitcoin-core: As shown below I have made ten contributions to the Bitcoin-core open-source project ranging from security improvements to the peer-to-peer networking layer to bugfixes and unittests. These contributions have been included downstream in projects such as Zcash, Bitcoin-ABC, Litecoin and many others.

Selected Open Source Software Contributions

  1. Bitcoin Improvement Proposals BIP-347 OP_CAT (Proposed Standard: Draft)
  2. Memguard Removes drop based finalizer (merged)
  3. VtNetCore Fixes a bug in OSC-112 control sequences (merged)
  4. Bitcoin-Core random: fixes read buffer resizing in RandAddSeedPerfmon (merged)
  5. Bitcoin-Core Limit the number of IPs we use from each DNS seeder (merged)
  6. Bitcoin-Core Add test-before-evict discipline to addrman (merged)
  7. Bitcoin-Core Feeler connections to increase online addrs in the tried table (merged)
  8. Bitcoin-Core Remove non-determinism which is breaking net_tests (merged)
  9. Bitcoin-Core Fix de-serialization bug where AddrMan is left corrupted (merged)
  10. Bitcoin-Core Adds unittests for CAddrMan and CAddrinfo, removes source of non-determinism (merged)
  11. Bitcoin-Core Creates unittests for addrman, makes addrman testable (merged)
  12. python-bitcoinlib Adding IPv6 support to addr messages with example code (merged)

Selected Trade Press and Media

Media Quotes and Interviews

Collider Script

OpenPubkey

BIP-347: Proposed OP_CAT improvement to Bitcoin

BastionZero

The Arwen Trading Protocols

Low-Resource Eclipse Attacks on Ethereum's Peer-to-Peer Network

Cryptanalysis of Curl-P and Other Attacks on the IOTA Cryptocurrency

Atomically trading with roger: Gambling on the success of a hardfork

An Empirical Analysis of Traceability in the Monero Blockchain

TumbleBit: An Untrusted Bitcoin-Compatible Anonymous Payment Hub

Eclipse Attacks on Bitcoin's Peer-to-Peer Network

(Blog Entry) Is PlayStation 4 Network Traffic Especially Difficult to Decrypt?

(Project) Potlucky Bitcoin Payment System

Selected Blog Posts

  1. The Terminal Escape Sequences Ocean is Deep and Dark: Debugging a Virtual Terminal
  2. The Design of Arwen's Ethereum Escrow Smart Contract
  3. Definitions of COLLECTION within the Intelligence Community and the Law.
  4. A Brief History of NSA Backdoors.
  5. Are IP Address Allocations Property?
  6. On the NSA's Thinking Behind the Decision to Backdoor a US Cryptographic Standard.
  7. A Review of William Liscum Borden's 'There Will Be No Time: The Revolution in Strategy'.
  8. Is PlayStation 4 Network Traffic Especially Difficult to Decrypt?
  9. A Brief Examination of Hacking Team's Crypter: core-packer.

Students Mentored

High School Students

Undergraduate Students