Koch Laboratory

TimeVault — cryptography of time, inheritance and conditional access

Five directions around a digital vault that needs no guard: 2-of-3 trust splitting, multi-factor recovery, and the boundary between attesting the past and enforcing the future — with documented redesigns.

Koch Laboratory — TimeVault: cryptography of time, inheritance and conditional access

This direction asks how a digital vault can enforce conditions that no trusted party polices: “open after my death, but not before”, “open only with these factors”, “do not even reveal how many secrets you hold”. The common denominator: the server and the software should be dispensable as guards — every guarantee that can be moved from application policy into cryptography is moved there, and the limits of that move are the actual research result.

It is the middle link of a multi-year lab research line on the cryptography of time and conditional access: from time-lock experiments with a consensus of time sources (2021), through the TimeVault family (2025–2026), to the general access-condition envelope in the messenger project (2026). Each link documents the limits of the previous one.

Method. As in the rest of the lab: problem → hypothesis → falsifiable criterion → method → result with boundary conditions; redesigns and dead ends are documented, not hidden.

Publication note (IP). For patentable directions we publish the problem, the state of the art and the success criterion — not the solution’s construction. Where “Construction: withheld” appears, the technical detail is retained as filing material.

1. 2-of-3 trust splitting: inheritance without a trusted server

Research question. Can a vault release access to an heir after the owner’s death if the storing service is at no point — including during the release — able to decrypt anything on its own? Why it is hard. Three parties (owner, heir, service) have conflicting requirements: the service must be able to participate in the release but not to perform it alone; the heir must have no access before the event; the owner must not be hostage to the service’s availability. State of the art (published). Shamir’s secret sharing (1979) over GF(256) — the primitive is state of the art; an own reference implementation with no external dependencies, with tests recovering from every pair of shares. Success criterion (tested). A single share reveals nothing about the secret; any two of three reconstruct the key; the release path (an inactivity switch or a verified death certificate) activates the service share only once the condition holds. Status: implemented + tests.

2. Multi-factor secret recovery: files as factors, order as information

Research question. How do you reconcile two conflicting properties of key recovery from material factors (key files): a main path in which the order of the factors is part of the secret, and an emergency path that survives the loss of some factors — without weakening either? Why it is hard. The emergency path is by definition a “back entrance” to the main path: every bit of recovery convenience is a bit of attack convenience. An additional requirement: the envelopes must not reveal which files are factors. State of the art (published). Shamir K-of-N; KDF/HKDF with domain separation; recovery codes over a confusion-resistant alphabet. Success criterion (tested). Wrong factor order — rejection; the K-of-N emergency path works in any order; below the threshold K — rejection; key material is zeroed after use. Construction (share-to-factor binding, match selection, envelope format): withheld (patent option kept open). Status: implemented + tests.

3. Boundary result: attesting the past ≠ enforcing the future

Thesis (published deliberately). Multi-source timestamping (independent time sources, a public hash registry, external anchoring) can prove the past — that data existed no later than time T. It cannot enforce the future: the condition “do not open before T”, enforced by local device policy, remains policy, not cryptography. Enforcing time without a trusted party (time-lock puzzles, VDFs, an external time quorum) is a separate, open direction — deliberately distinguished from what already works. Why we publish this. The distinction is a research result in itself: it states precisely which part of the “cryptography of time” is closed and which remains the program’s open technical uncertainty. State of the art (published). RFC 3161/TSA and anchoring in public chains (attesting the past); time-lock puzzles (Rivest–Shamir–Wagner), VDFs (enforcing the future — outside the current implementation). Status: timestamping and the inactivity switch — implemented + tests; cryptographic enforcement of the future — open research question.

4. Deniability of the number of stored secrets

Research question. Can a vault container avoid revealing how many real secrets it holds — so that an observer (or coercion) cannot distinguish a full vault from a partially empty one? Why it is hard. Every distributional difference — lengths, structure, metadata, unlock behaviour — is a signal. Deniability must also survive inspection of the container file itself. State of the art (published). The hidden-volume class of solutions (VeraCrypt and relatives) — together with their known limits. Success criterion. A container with k real secrets is indistinguishable, to an observer without the correct factors, from a container with k′ ≠ k. Construction (filling of empty slots, unification of policies and behaviour): withheld (patent option kept open). Status: implemented / in validation.

5. Redesigns and negative results (published)