The headline Beyond MPC Structural Cost The floor

Deep dive · What is unusual

Properties

A handful of guarantees follow from the design that are unusual or simply unavailable in existing recovery systems.

None of them require new cryptography. They come from composing standard, audited primitives in a new configuration.

The headline property

The behaviour of witness encryption, from primitives you can actually deploy.

Witness encryption is the ideal for conditional recovery: a ciphertext that opens only for whoever holds a valid witness, with no counterparty at all. It is not deployable in any practical form today. Nihilium reproduces its functional behaviour for the recovery task using only standard components, with operator counterparties whose deviation is held in check by an enforcement layer.

Below*

MPC recovery

Deployable, but collusion is silent and refusal has no recourse.

Where Nihilium sits

Deployable, and enforced

A strict superset of MPC recovery on every operator-deviation dimension, matching it on threshold security.

Above

Witness encryption

The theoretical ceiling, with no counterparty. Not deployable today.

* "Below" ranks these only on the operator-deviation axis, and only within conditional recovery. MPC is a general-purpose primitive that does far more than recovery, joint signing, private computation, and much of operational security among it, most of which Nihilium does not attempt. The comparison here is narrowly scoped to the recovery task the two share.

Three properties MPC recovery lacks

Cheating stops being free.

A distributed key system gives you threshold security. Nihilium adds the accountability layer that operator-based recovery has always been missing.

Detection

Deviation is attributable

Any partial decryption or scalar that appears outside a valid unsealing traces, via DLEQ proofs and signed pre-images, to one operator's registered keys. Leaking leaves a fingerprint.

Punishment

Slashing is permissionless

Attribution triggers on-chain slashing of the operator's entire stake. Anyone who observes the leaked material can open the challenge; no privileged role is required.

Enforcement

Refusal is not an exit

Declining a valid request triggers forced execution on-chain, the same slashing offence as leaking early. Liveness is enforced, not merely hoped for.

Structural properties

What the shape of the protocol gives you for free.

These fall out of the client-proves design and the combinatorial construction, not from any single feature bolted on top.

No ceremony, no shared state

There is no distributed key generation and no cohort setup. The client picks its own k-of-n processors per seal, with per-seal latitude over jurisdiction, stake, and provider mix.

The client proves, the processor validates

Inverting the usual responsibility keeps processors stateless and light, makes the condition language extensible with no operator software updates, and hides condition contents from processors until unsealing.

Every attempt is observable

Each seal posts a small public marker to a shared datastream the moment an unsealing begins. The owner, and anyone they designate, gets provable evidence that an opening has been attempted, and when, or that none ever has.

A one-way deposit box

Each seal accepts append-only deposits from third parties who cannot read the existing contents. A sealed store keeps accumulating data long after it was created, and opens only once.

A tunable collusion barrier

The one collusion path that leaves no slashable artefact is bounded by a per-seal computational cost that scales, at default parameters, into multi-million-dollar infrastructure. Evidence-free cheating is made irrational.

Stake covers zero-value components

Value decomposition means what is sealed is a component worthless in isolation, like a password without its file. Processor stake need only exceed that extractable value, which is zero under correct usage.

Computational cost

The heavy work runs on the client. Price falls toward a cent per seal.

Proof generation and encryption all happen on the client's own device. Processors stay stateless: no distributed ceremony, no network communication overhead between operators, and no hot state to hold open between requests. What remains is close to pure operational cost, and that cost falls as volume rises.

Heavy compute is client-side

ZK proofs and homomorphic encryption are generated on the client's device. Processors only validate and perform bounded scalar operations, never discrete-log solving.

No coordination, no hot state

There is no operator-to-operator network overhead and no shared state kept warm between requests. A processor scales horizontally with nothing to synchronise.

Cost gravitates to operations

With the cryptography offloaded, per-seal cost is almost entirely operational. More seals amortise that overhead further, so unit price drops as the network grows.

The target

~1¢ per seal

The direction of travel: consumer-scale conditional recovery priced like any ordinary API call.

The safety floor

Even if the enforcement layer fails, security never drops below MPC.

If the slashing contract were unavailable or the chain halted, the extra guarantees switch off but the cryptographic threshold guarantees remain intact. The protocol degrades exactly to MPC-equivalent recovery and never below it. The two layers are orthogonal: cryptography makes cheating provable, economics makes it costly.

No new mathematics. Established primitives, composed so that the best case behaves like witness encryption and the worst case behaves like MPC.

Overview Conditions Sealing Unsealing Threshold Properties Primitives SDK