Three independent dials set how available a seal is, how many must cooperate to open it, and how expensive it is to cheat.
Turn them separately to place a seal exactly where you want it, from a light consumer wallet to critical infrastructure.
The starting point
Splitting the secret is not enough.
The obvious way to share a secret across k of n parties is Shamir secret sharing: split a key that already exists into shares, so any k reconstruct it and fewer learn nothing. The problem is right there in the setup. The key existed first, which means someone saw it, and the shares only ever recombine into that same known value.
Shamirkey existed first, someone saw it
A leaked share is unattributablecould be any holder, or the client
Nihiliumkey no one has ever seen
Attribution collapses
If a share surfaces, you cannot tell who leaked it. The client already knew the key and could have shared it themselves, so possession of a share proves nothing. Without attribution there is nothing to slash.
The secret must be brand new
The whole point is a key no party has ever held, not the re-splitting of one that already exists. Shamir starts from a known value, so it can never give you a secret nobody has seen.
The homomorphic answer
Each processor contributes a homomorphically encrypted piece, and a combinatorial combination of those pieces forms a vault key no one has ever seen. Every contribution stays attributable, so the properties Shamir loses are preserved.
Three parameters
n, k, and m do three separate jobs.
They are genuinely independent. Change one without disturbing the others, and reason about each on its own terms.
n
Availability
The size of the processor pool. More processors means more qualifying groups, so more independent ways the secret can still be recovered.
k
Collusion threshold
How many processors must cooperate to open a seal. This is the number an attacker has to compromise at once. The threshold is independent of N (but must be less). 2/10 also works.
m
Search width
The number of lanes per processor. It sets how much work a cheating quorum must redo, multiplying the cost of every attempt. M exists to force MPC collusion into oblivious search making it prohibitly expensive. It acts as a detterent.
Availability
Any qualifying group is a full recovery path.
With n processors and threshold k, every k-subset the client sets up is an independent way in. Choose n and k so that enough groups stay reachable even when some operators are offline. The redundancy is a deliberate choice made at sealing, not something the protocol grants automatically.
a
b
c
d
e
n = 5 pool, one lit group of k = 3
10qualifying groups
Every one of the ten k-subsets is a self-contained way to recover. Lose a couple of operators and the rest still open the seal.
The collusion cost
Search width raises the cost of cheating combinatorially.
The one collusion path that leaves no evidence has to run the entire recovery inside a joint computation that never reveals an intermediate value. There, the honest client's cheap local search becomes brutally expensive, and every extra lane multiplies the number of candidate paths that must be ground through.
m = 2
few paths
m = 5
many more
m = 15
astronomically many
mk
candidate paths a colluding quorum must search, versus one cheap lookup for the legitimate client.
Cheating is meant to be irrational, not impossible. The barrier stacks on top of the detection and slashing layers: any cheaper path leaves evidence, and the only evidence-free path is the expensive one.
Placing a seal
Same protocol, dialed to the job.
Because the three parameters move independently, the same construction spans very different risk profiles.
Consumer wallet
Modest k and m keep recovery fast and cheap, with enough n that everyday availability never depends on one operator.
High-value vault
Raise k so more parties must collude, and raise m so any evidence-free attempt is prohibitively expensive.
Critical infrastructure
Push all three up. A large pool for availability, a high threshold, and wide search that turns collusion into years of joint computation.
Availability, collusion resistance, and cheating cost are three separate dials, so a seal can sit exactly where its risk demands.