Threshold key management: the key that never exists

If state is encrypted, the obvious question is: who holds the key? Celar's answer: no one, ever. The TFHE decryption key exists only as shares spread across a 100-seat committee — generated by a distributed ceremony, never reconstructed anywhere, at any time, including during recovery.

How it works

• Distributed key generation. A publicly verifiable ceremony produces key shares with published transcripts; misbehaving participants are excluded before genesis.
• Threshold decryption. Any decryption or re-encryption requires a quorum of seats to cooperate. Every partial decryption is signed, attributable, and fraud-provable — unauthorized service is severely slashed. The key-committee confidentiality threshold is 24-of-100 as deployed in production ceremonies — any 24 seats learn nothing, and reconstruction requires strictly more. A development keyability run at c = 100 used threshold 33. The design target is 79-of-100, and the gap is a property of the preprocessing engine in use rather than of the design — decoupling the sharing degree from the session threshold is available in the literature, deployed in another threshold-FHE library, and is engineering Celar is undertaking. Whitepaper §7.1 states both figures and the path.
• Proactive resharing. Shares refresh every epoch, making old shares useless. An attacker must corrupt a full decryption quorum within a single epoch, against seats that rotate on staggered 25-epoch terms.
• Noise-flooded decryption. Authorized partial decryptions carry calibrated noise so repeated decryptions stay safe even against adversarially crafted ciphertexts.

A security number you can check

Most chains say "decentralized." Celar states a bound: the probability that an adversary holding 55% of eligible stake captures a decryption quorum within a rolling 10-year window is ≤ 1 in 10,000 — a constitutional constant, re-derived annually and on any parameter change, weakening it is hard-fork-only. On top sits the live health rule ℋ ≥ 2: attacking must always cost at least twice what it could steal.