tlock: practical timelock encryption from threshold BLS

Nicolas Gailly1, Kelsey Melissaris2, Yolan Romailler1

1 Protocol Labs 2 Department of Computer Science Aarhus University, Denmark

Abstract. We present a practical construction and implementation of timelock encryption, in which a ciphertext is guaranteed to be decryptable only after some specified time has passed. We employ an existing threshold network, the League of Entropy, implementing threshold BLS in the context of Boneh and Franklin’s identity-based encryption (BF-IBE). At present this threshold network broadcasts BLS signatures over each round number, equivalent to the current time interval, and as such can be considered a decentralized key holder periodically publishing private keys for the BF-IBE where identities are the round numbers. A noticeable advantage of this scheme is that only the encryptors and decryptors are required to perform any additional cryptographic operations; the threshold network can remain unaware of these computations and does not have to change to support the scheme. We also release an open-source implementation of our scheme and a live web page that can be used in production now relying on the existing League of Entropy network acting as a distributed public randomness beacon service using threshold BLS signatures.

Keywords: Time-lock · Timelock · Timed-release · Time-lapse · Threshold · Pairing

1 Introduction

Timelock encryption (TLE) was first introduced on the Cypherpunks mailing list in 1993 by Tim May, the founder of the crypto-anarchist movement, and subsequently received additional attention thanks to Rivest, Shamir and Wagner in 1996. The notion of TLE can be expressed simply: ciphertexts are guaranteed to be decryptable after a specified point in time. As the name suggests TLE ciphertexts remain locked until the designated time, after which even the encryptor cannot prevent decryption. Timelock encryption finds multiple applications:

– Sealed-bid auctions in which encrypted bids are decryptable only after the bidding period has elapsed; – Mitigation of preservation risk during embargo periods e.g. for legal documents, confessions, or vulnerability reports with coordinated disclosure, by ensuring that a document can only be decrypted after a given time period; – Conditional transfers of assets by encrypting private keys to a given future time, and relocating funds prior to release time should the wealth transfer be deemed unnecessary; – Miner extractable value (MEV) prevention mechanism in which transactions in a blockchain are encrypted via a timelock scheme in order to prevent miners from performing MEV attacks.

1.1 Prior art

Initial approaches to practical timelock encryption were founded upon proof-of-work systems, with security guaranteed under the assumption that some puzzle requires a certain amount of sequential computation, and therefore time, to solve. Time-lock puzzles were introduced by Rivest, Shamir and Wagner, noting:

"There are two natural approaches to implementing timed release crypto:"

– Use "time-lock puzzles"–computational problems that cannot be solved without running a computer continuously for at least a certain amount of time. – Use trusted agents who promise not to reveal certain information until a specified date.

Using trusted agents has the obvious problem of ensuring that the agents are trustworthy.

A theoretical formalization of time-lock puzzles can be found in literature. Time-lock puzzles are inherently founded in proof of work and are therefore highly sensitive to unpredictable advances in both hardware and algorithms. For instance, the LCS time-lock puzzle released in 1999 by Ron Rivest was successfully solved fifteen years early in 2019 via two independent methods. Rabin and Thorpe propose relying on distributed key generation, verifiable threshold secret sharing, and ElGamal encryption where multiple parties implement a "Time-Lapse Cryptography Service" by publishing public keys and then releasing the related private keys at given times. As of now, such a service has never been implemented and deployed in practice.

Threshold networks have also been used as an encryption "recipient." For example, Ferveo and Shutter are systems where users encrypt their transactions for threshold networks. In comparison, our scheme does not rely on the threshold network to perform any operation per ciphertext, but simply to emit one value per round and the decryption happens publicly. Anyone can compute a valid decryption of a ciphertext encrypted for this round.

1.2 Our contributions

We present, implement and benchmark a secure timelock encryption (TLE) scheme from the League of Entropy (LoE), a production-ready randomness beacon currently deployed over drand nodes. Our timelock encryption scheme permits encryption under existing public parameters, previously generated and utilized by the existing threshold network, such that ciphertexts can be decrypted by any party given only certain time-related information already broadcast by that network. We provide the first implementation and benchmarks for this approach.

League of Entropy

The LoE is a threshold network in which each member holds a share of an unknown secret, generated via a Distributed Key Generation (DKG) procedure. Periodically the network computes and broadcasts a threshold BLS signature over the round number associated with the current timestamp. The LoE has been in production since 2020, comprising 23 nodes operated by various entities, and is already used by large networks, e.g. Filecoin.

Identity Based Encryption

Identity-based encryption (IBE) is an encryption paradigm which replaces public keys with public identity strings, e.g. emails, names, addresses, etc. We exploit an equivalence between IBE and TLE to construct our scheme. Timelock encryption is achieved by employing Boneh and Franklin’s IBE to encrypt under the round number as the public identity string. As that round number is associated with a unique timestamp, this is equivalent to encrypting under time. When the BLS signature on that round number is released by the LoE, anyone can use that signature to decrypt messages.

2 Preliminaries

2.1 Groups & Computational Assumptions Bilinear Maps

A type-III bilinear group is described via specific mathematical properties, facilitating efficient computation of pairing operations necessary for the timelock encryption scheme.

2.2 Threshold BLS Signatures

BLS signatures are digital signatures provably secure under the Gap Diffie-Hellman assumption on the underlying group. The BLS signature admits a threshold construction in which the signing key is jointly generated by n nodes.

2.3 Identity-Based Encryption

IBE is defined through a series of algorithms providing capabilities for encryption and decryption based on identity strings. We define a security model ensuring robustness and correctness of IBE implementations.

3 Timelock Encryption

Agent-based TLE

Timelock Encryption (TLE) is classified into agent-based and puzzle-based implementations. Our scheme adopts the agent-based approach, allowing for periodic publishing of decryption keys.

Publicly Decryptable TLE

Our TLE definition stipulates that ciphertexts are decryptable by any party given only the round key. This contrast traditional designated-decryptor TLE.

Definition 2 (Timelock Encryption (TLE) Scheme)

A Timelock Encryption scheme T is a tuple of polynomial-time algorithms:

• SetUp(1 λ ) → (pp, ask)
• RoundKey(pp, ask,ρ) → πρ
• Encrypt(pp,ρ,M) → ctρ
• Decrypt(pp,πρ, ctρ) → M ′

Correctness

Perfect TLE correctness requires that decryption yields the original message when the corresponding round key and ciphertext are provided.

Indistinguishability

Our TLE security models habitually consider distinguishing between encrypted messages, ensuring robustness against chosen-plaintext and chosen-ciphertext attacks.

4 Threshold Timelock Encryption: Definition & Model

We adapt TLE to threshold situations where a threshold network acts as the trusted agent. Definitions and models regarding threshold cryptocurrencies are provided, guaranteeing security against malicious actors.

Threshold Timelock Encryption Definition

A Threshold Timelock Encryption scheme T is a pair of interactive algorithms and a pair of polynomial-time algorithms:

• Π -tSetUp(1 λ , th) → (pp, mpk)
• Π -tRoundKey(pp,ρ) → πρ
• Encrypt(pp,ρ,M) → ctρ
• Decrypt(pp,πρ, ctρ) → M ′

5 Our Threshold Timelock Encryption Scheme

Our scheme implements key differences comparing to existing IBE decoupling methods, enhancing security through threshold network implementations.

6 Implementation

6.1 The League of Entropy

We leverage the League of Entropy as our practical instantiation, relying on drand nodes to provide randomness beacon service through BLS signatures.

6.2 Implementation

We have created implementations in Go and Typescript, providing open-source libraries and tools to perform timelock encryption.

6.3 Benchmarks

Benchmark comparisons between Go and Typescript library implementations show performance efficiencies across multiple operations necessary for timelock encryption.

6.4 Tradeoffs

Discussions about the advantages and disadvantages between using G1 and G2 presentations in the BLS system reveal different tradeoffs in performance and size for public key versus signatures.

7 Future Work

Future aspirations for the timelock encryption include batch decryption optimizations, random linear combinations, and potentially enhancing schemes to be quantum-resistant.

8 Acknowledgements

We express appreciation for significant contributions and insights shared by various individuals that helped shape our research and implementations.

References

A list of relevant literature and sources that provide foundational components and previous work in the field of timelock encryption and threshold signatures.