A handful of guarantees follow from the design that are unusual or simply unavailable in existing recovery systems.
None of them require new cryptography. They come from composing standard, audited primitives in a new configuration.
The headline property
The behaviour of witness encryption, from primitives you can actually deploy.
Witness encryption is the ideal for conditional recovery: a ciphertext that opens only for whoever holds a valid witness, with no counterparty at all. It is not deployable in any practical form today. Nihilium reproduces its functional behaviour for the recovery task using only standard components, with operator counterparties whose deviation is held in check by an enforcement layer.
Below*
MPC recovery
Deployable, but collusion is silent and refusal has no recourse.
Where Nihilium sits
Deployable, and enforced
A strict superset of MPC recovery on every operator-deviation dimension, matching it on threshold security.
Above
Witness encryption
The theoretical ceiling, with no counterparty. Not deployable today.
* "Below" ranks these only on the operator-deviation axis, and only within conditional recovery. MPC is a general-purpose primitive that does far more than recovery, joint signing, private computation, and much of operational security among it, most of which Nihilium does not attempt. The comparison here is narrowly scoped to the recovery task the two share.
Three properties MPC recovery lacks
Cheating stops being free.
A distributed key system gives you threshold security. Nihilium adds the accountability layer that operator-based recovery has always been missing.
Detection
Deviation is attributable
Any partial decryption or scalar that appears outside a valid unsealing traces, via DLEQ proofs and signed pre-images, to one operator's registered keys. Leaking leaves a fingerprint.
Punishment
Slashing is permissionless
Attribution triggers on-chain slashing of the operator's entire stake. Anyone who observes the leaked material can open the challenge; no privileged role is required.
Enforcement
Refusal is not an exit
Declining a valid request triggers forced execution on-chain, the same slashing offence as leaking early. Liveness is enforced, not merely hoped for.
No cheap, clean collusion path
Cheap leaves evidence. Evidence-free is expensive.
Silent collusion needs a path that is both computationally cheap and free of any attributable artefact. The construction removes it. To reconstruct the way the legitimate client does, colluders must materialise the hidden scalars in the clear, but every scalar is signed by the processor that produced it, so materialising one hands every co-conspirator a permanent, permissionlessly slashable confession, enforceable by anyone, forever. The only way to avoid that evidence is to run the entire recovery inside oblivious computation, where the client's cheap local search becomes the mk oblivious search that the m parameter is tuned to make prohibitive.
The cheap path
Leaves a signed confession
Reconstructing in the clear is fast, and it is exactly what the detection layer is built to catch. Every scalar carries its producer's signature, so the shortcut turns each participant into a permanent, slashable witness against the rest.
The clean path
Costs an mk search
Leaving no artefact means never revealing an intermediate value, which forces the whole recovery into oblivious computation. One cheap lookup for the client becomes a grind through every candidate path, priced by the search width.
There is no path that is both. Every cheap route to the secret leaves an artefact anyone can slash on, and the only route that leaves nothing behind is the one the search width makes unaffordable.
Scope. This defends the case the threshold is meant to defend: independent processors each deciding to cheat. A single entity that already controls k processors is below threshold by definition and can reconstruct cheaply on its own machines. That is the standard k-of-n assumption every such system makes, and it is exactly the safety floor below.
Structural properties
What the shape of the protocol gives you for free.
These fall out of the client-proves design and the combinatorial construction, not from any single feature bolted on top.
No ceremony, no shared state
There is no distributed key generation and no cohort setup. The client picks its own k-of-n processors per seal, with per-seal latitude over jurisdiction, stake, and provider mix.
The client proves, the processor validates
Inverting the usual responsibility keeps processors stateless and light, makes the condition language extensible with no operator software updates, and hides condition contents from processors until unsealing.
Every attempt is observable
Each seal posts a small public marker to a shared datastream the moment an unsealing begins. The owner, and anyone they designate, gets provable evidence that an opening has been attempted, and when, or that none ever has.
A one-way deposit box
Each seal accepts append-only deposits from third parties who cannot read the existing contents. A sealed store keeps accumulating data long after it was created, and opens only once.
A tunable collusion barrier
The evidence-free path above is bounded by a per-seal computational cost that scales, at default parameters, into multi-million-dollar infrastructure. The barrier is a dial, set per seal at sealing time.
Stake covers zero-value components
Value decomposition means what is sealed is a component worthless in isolation, like a password without its file. Processor stake need only exceed that extractable value, which is zero under correct usage.
Computational cost
The heavy work runs on the client. Price falls toward a cent per seal.
Proof generation and encryption all happen on the client's own device. Processors stay stateless: no distributed ceremony, no network communication overhead between operators, and no hot state to hold open between requests. What remains is close to pure operational cost, and that cost falls as volume rises.
Heavy compute is client-side
ZK proofs and homomorphic encryption are generated on the client's device. Processors only validate and perform bounded scalar operations, never discrete-log solving.
No coordination, no hot state
There is no operator-to-operator network overhead and no shared state kept warm between requests. A processor scales horizontally with nothing to synchronise.
Cost gravitates to operations
With the cryptography offloaded, per-seal cost is almost entirely operational. More seals amortise that overhead further, so unit price drops as the network grows.
The target
~1¢ per seal
The direction of travel: consumer-scale conditional recovery priced like any ordinary API call.
The safety floor
Even if the enforcement layer fails, security never drops below MPC.
If the slashing contract were unavailable or the chain halted, the extra guarantees switch off but the cryptographic threshold guarantees remain intact. The protocol degrades exactly to MPC-equivalent recovery and never below it. The two layers are orthogonal: cryptography makes cheating provable, economics makes it costly.
No new mathematics. Established primitives, composed so that the best case behaves like witness encryption and the worst case behaves like MPC.