Work

IETF · Cloudflare · Code · Presentations

At Cloudflare I work on Privacy Pass and bot authentication. At the IETF, I write specs and chair the OCM working group.

IETF Link to heading

I chair the Open Cloud Mesh (OCM) working group, standardising federated file sharing across organisations. At the W3C, I co-chaired PACT, the workshop on private access control.

• HTTP Message Signatures for Automated Traffic — draft-meunier-webbotauth-httpsig-protocol
• HTTP Message Signatures Directory — draft-meunier-webbotauth-httpsig-directory
• Registry and Signature Agent Card for Web Bot Auth — draft-meunier-webbotauth-registry
• Moderation of unLinkable Endorsements (MoLE) Architecture - draft-jms-mole-architecture
• MoLE HTTP Transport - draft-jms-mole-http-transport
• MoLE Protocols - draft-jms-mole-protocols
• Batched Token Issuance Protocol — draft-ietf-privacypass-batched-tokens (Submitted for Publication)
• Privacy Pass Reverse Flow — draft-meunier-privacypass-reverse-flow

More on the IETF Datatracker.

Cloudflare Link to heading

• Moving past bots vs. humans (2026)
• Forget IPs: using cryptography to verify bot and agent traffic (2025)
• Beyond IP lists: a registry format for bots and agents (2025)
• Anonymous credentials: rate-limiting bots and agents without compromising privacy (2025)
• Sometimes I cache: implementing lock-free probabilistic caching (2024)
• Cloudflare helps verify the security of end-to-end encrypted messages by auditing key transparency for WhatsApp (2024)
• Privacy Pass: upgrading to the latest protocol version (2024)
• Let The Right One In: Attestation as a Usable CAPTCHA Alternative — SOUPS 2022
• Humanity wastes about 500 years per day on CAPTCHAs. It’s time to end this madness (2021)

More on the Cloudflare blog.

Code Link to heading

• tlock-rs — Rust encryption library for practical time-lock encryption
• drand-rs — drand client in Rust
• age-plugin-simplepq — Simple post-quantum plugin for age
• age-plugin-hpke — HPKE plugin for age
• http-message-signatures-directory — Proposal for signing bot traffic with per-provider keys
• ohttp-ts — Oblivious HTTP implementation in TypeScript
• quicvarint — Variable-length integer encoding from RFC 9000
• doh-proxy-worker-template — DNS over HTTPS Cloudflare Worker

Presentations Link to heading

• Des lampes à lave pour sécuriser Internet — Cloudflare, 2024. How lava lamps generate entropy to secure the web.
• Le développement d’un outil de chiffrement et l’importance de son interface utilisateur — Capitole du Libre, 2023. Building dee and timelock encryption.