Every system that encrypts data has to answer one question before any other: who can decrypt it? For most, the honest answer is uncomfortable — a company holds a key, or a key lives inside a hardware enclave you have to trust, or a small operator set could reconstruct it if they wanted to. The encryption is only ever as strong as the answer to that question, and the answer is usually a single point of trust wearing a technical disguise.
Celar's answer is that no one can decrypt — not the team, not a validator, not any single party, ever. The network's decryption key is never assembled anywhere, at any time. It's not stored in a vault with good access controls. It doesn't exist as a whole.
01 /Born in pieces
The key is generated distributed. It exists only as shares spread across a 100-seat committee, and producing any plaintext requires a threshold quorum of those seats to cooperate on that specific decryption. No seat holds the key; no subset below the threshold learns anything; the full key is never reconstructed even in the moment of use.
P(capture) ≤ 10⁻⁴ // 10-year campaign, adversary ≤ 55% of stake
shares refresh every epoch · partials signed, attributable, slashable
That turns "who do you trust" from a party into a threshold. To break confidentiality, an attacker doesn't compromise a server or subpoena a company — they have to capture a full quorum of independent, staked committee seats at once. And that capture bound isn't a number you take on faith either; every input to it is published (see the ℋ metric).
02 /A moving target
A distributed key that never changes is still a target you can chip away at over years. So the shares refresh every epoch — proactive resharing redraws the secret-sharing without ever reconstructing the key. An attacker who quietly compromises a handful of seats over months gains nothing: the shares they stole are stale the next epoch. To reach the threshold they must hold a full quorum simultaneously, within a single epoch, not accumulate them over time. Patience stops being an attack strategy.
03 /Attributable and slashable
Distribution handles can they; accountability handles what if they try. Every partial decryption a committee member produces is signed and attributable — there's no anonymous contribution to a decryption. So a member serving an unauthorized decryption isn't just detectable; the signed partial is evidence, and evidence feeds a fraud proof that gets them severely slashed.
Every decryption also requires authorization from the data's owner or the contract that governs it; a partial served against that authorization predicate is exactly what the slashing path exists to punish. Misbehavior isn't a silent risk you hope doesn't happen — it's an on-chain offense with a bonded penalty.
04 /No enclave, no vendor, no subpoena
Notice what's not in the trust root. There's no hardware enclave — no "trust this chip and its manufacturer" — so there's no side-channel or vendor firmware to worry about. There's no external key-management service run by a company, so there's no corporate entity to compromise, coerce, or serve with a legal order. The trust root is threshold cryptography plus staked, slashable seats inside Celar's own consensus. Security rests on distribution and economics — both visible and priced — rather than on a physical or corporate secret you're asked to believe in.
05 /The honest caveat
Here's the part we put in our own PF-1 label rather than hide: this is HIDDEN-C, not HIDDEN-U. Confidentiality holds unless the committee colludes at threshold — a quorum acting together could decrypt. That's a real, disclosed assumption, and it's why the FHE-encrypted tier is a committee-trust guarantee, not an unbounded-collusion one. (For the property that survives even total collusion, that's the ZK shielded pool — different tier, different job.)
What makes the assumption defensible isn't a promise that a quorum of honest people stay honest. It's that collusion is made economically irrational by the ℋ rule — capturing the threshold has to cost more than it could ever yield — and operationally hard by epoch resharing and slashing. We'd rather name the assumption precisely and show why it holds than sell you "trustless" and let you discover the committee later. At genesis the committee is permissioned (a vetted seat set); it opens to permissionless participation as the staking and vetting machinery matures.
06 /The point
Most encrypted systems answer "who can decrypt?" with a party you have to trust and a story about why they won't misuse it. Celar answers with a threshold nobody can reach alone, shares that expire before you can accumulate them, and a signed, slashable penalty for trying — a key that is never assembled, held, or hidden anywhere, because it never exists as a whole in the first place.
CONTACT — press@celar.network · LIVE METRIC — celar.network/health · $CELAR