← Nihilium
Composition The stack Key choices Post-quantum
Deep dive · The toolbox

Primitives

The construction introduces no new mathematics. It composes standard, audited primitives in a new configuration.

Every component below runs on established libraries: Groth16 over bn254, ECElGamal and EdDSA over Baby Jubjub, Keccak Merkle trees, and an EVM enforcement layer.

Primitive composition

Existing techniques, in a novel configuration.

Each technique carries one clear role. The novelty is entirely in how they combine, not in any single piece.

Combinatorial threshold encryption
Redundancy, liveness, and oracle-resistant threshold recovery from independently generated keys.
Composite-key HE with closed-loop pairing
Cross-processor dependency at decryption. Eliminates unilateral and additively-masked extraction paths.
EC-ElGamal scalar-as-point encoding
A tunable MPC collusion barrier via the intrinsic DLP asymmetry between local and oblivious search.
Zero-knowledge proofs (Groth16)
Client-side condition proofs and composite-key membership proofs, all generated at sealing time.
Blockchain (EVM) and staking
Enforcement only: slashing, registration, forced execution. Stake is reputation capital, not per-seal collateral.
TEEs & MPC's (optional)
Optional operational security hardening for processors. Not required by the security model.
The stack

Every primitive, specified.

No pairings, multilinear maps, or lattice-hard operations in the current construction. Just point arithmetic, hashes, and ZK proofs.

Primitive
Specification
Notes
{{ row.name }}
{{ row.spec }}
{{ row.note }}
Key choices

Why these, and what they trade.

Three decisions shape the deployable footprint. Each has a documented migration path if requirements change.

Proof system
Groth16, compiled with Circom
Chosen for a compact ~200-byte proof and efficient on-chain verification. The cost is a trusted setup (universal Powers of Tau plus a per-circuit phase). The architecture supports migration to PLONK or STARK, Groth16 was chosen for it's maturity.
Curves
bn254 for ZK, Baby Jubjub for HE and signatures
bn254 gives roughly 100 bits of security following the Kim-Barbulescu results; Baby Jubjub is the efficient in-circuit companion. Migration to other curves, would be engineering not fundamental.
Encryption
ECElGamal with scalar-as-point encoding
CPA-secure, with 30-bit input chunks in a 32-bit ciphertext space decrypted by BSGS. The encoding produces the local-versus-MPC asymmetry that makes evidence-free collusion expensive.
Post-quantum migration path

Every core operation has a direct lattice-based equivalent.

The construction reduces to EC point additions, scalar multiplications, hash evaluations, and ZK proofs. No pairings, multilinear maps, or lattice-hard operations are used today, and that operational simplicity is exactly what makes the migration tractable.

Additively homomorphic encryption
The central mechanism. LWE-based encryption is natively additively homomorphic, so Regev and its ring variants support the same three-party composite-key composition without modification.
Signatures
EdDSA on Baby Jubjub maps to ML-DSA (Dilithium), the NIST-standardised lattice scheme. Signatures are used only for commitment binding and authentication, with no dependence on internal structure.
No new mathematics. Established primitives, chosen so the deployable footprint is small today and the migration path stays open tomorrow.
Overview Conditions Sealing Unsealing Threshold Properties Primitives SDK