Threshold key management: the key that never exists
If state is encrypted, the obvious question is: who holds the key? Celar's answer: no single seat, and no party below the threshold. The TFHE decryption key exists only as shares spread across the committee, generated by a distributed ceremony. Threshold decryption never reconstructs it; a coalition larger than the threshold (13 or more seats) could, and that limit is stated below.
How it works
- Distributed key generation. A publicly verifiable ceremony produces key shares with published transcripts; misbehaving participants are excluded before genesis.
- Threshold decryption. Any decryption or re-encryption requires a threshold quorum of seats to cooperate. Partial decryptions are designed to be attributable to the seat that produced them, so unauthorized service can be proven and penalised; that penalty is not yet built. The committee configuration is 50 seats, threshold 12 — run and verified end-to-end in a test ceremony, and not yet securing value. Up to 12 seats learn nothing; 13 colluding seats could reconstruct the key, and we publish that rather than hide it. Thirteen seats are not thirteen independent parties: under today's admission rules, as few as two network operators, cloud providers or client implementations could together hold thirteen seats — whitepaper §7.1 publishes that figure too. Larger committees are not reachable on this engine, and no work is scoped to reach them. Whitepaper §7.1 states the configuration and its limits.
- Proactive refresh. Proactive refresh is implemented and validated: the committee re-randomizes every share without changing the key. Attested erasure of superseded shares is implemented as well; once operators are bound to it, refresh will also limit how long an attacker has to assemble a quorum. Seat rotation on staggered terms is designed but deferred.
- Noise-flooded decryption. Authorized partial decryptions carry calibrated noise so repeated decryptions stay safe even against adversarially crafted ciphertexts. That safety assumes a per-key-epoch decryption budget. Today each seat counts its own decryptions, so a coalition at the threshold could exceed the budget; making the count fleet-wide is specified and not yet built — the figure is stated in §7.2 of the technical whitepaper, whose public edition is in the data room.
A security number you can check
Most chains say "decentralized." Celar states a bound and publishes its inputs. How much stake it would take to capture a decryption quorum, and how likely that is over a rolling 10-year window, is set out as a curve on the health dashboard and in whitepaper §7.7 — it is a curve rather than a single number, and at this committee size a sufficiently large adversary captures every configuration. On top sits the live health rule ℋ ≥ 2: attacking must always cost at least twice what it could steal.