Tulva lets enough committee members decrypt without being online together

In plain words

The research

What the evidence shows

• When committees rotate

  Tulva is a compiler that adds asynchronous threshold decryption to compatible fully homomorphic encryption (FHE), which lets computers compute on encrypted data. In threshold decryption, K shareholders hold shares of a dedicated key and enough of them must contribute to recover the result.

  Tulva lets those contributions arrive independently, even at different times. That addresses a changing committee: confidential smart-contract requests may arrive unpredictably, while synchronous schemes can require decryptors to agree in advance or be online together.

• Switch ciphertext to a second layer

  To do this, Tulva publicly key-switches a ciphertext into a separate threshold public-key encryption layer, leaving the FHE computation in its own layer. Only the dedicated decryption key for the second layer is shared among shareholders; a public combiner reconstructs the result from enough partial decryptions.

  A fresh random tag is appended and refreshed after homomorphic operations, providing randomness used in the proof against limited partial-decryption requests.

• The proof covers partial leakage

  The authors prove chosen-plaintext confidentiality: an attacker who selects two messages cannot reliably tell which one a challenge ciphertext encrypts. The game permits corruption of fewer than t shareholders and fewer than t minus the number corrupted in partial-decryption requests for each ciphertext whose plaintext differs between the two challenge cases.

  The proof also assumes linear decryption and confidentiality for the base FHE, learning-with-errors hardness, and the construction’s parameter constraints.

• Separate preparation from decryption

  The TFHE-based implementation was tested at ring sizes 256 and 2,048, with threshold profiles up to 512 shareholders. In the small-ring, single-message 16-of-512 setting, median public preparation took 0.5 seconds, while partial decryption took 3.7 milliseconds and share combination took 0.5 milliseconds after that preparation.

  Separating these phases shows that public, ciphertext-dependent preparation and the active decryption work have different timing roles.

• Online latency and committee size

  Against Zyskind et al. ’s interactive method, where decryptors communicate during rounding, the authors compared single-ciphertext active latency at matched party counts and network delays. At 10 ms and four parties, Tulva took 10.68 ms versus the reported 55.62 ms; the same machine was used as reported, and Tulva’s public preparation was excluded.

  This supports lower latency for the tested online phase, while its public setup remains outside that comparison. Separately, the paper reports that Tulva supports 32 times as many total users as this scheme, which requires all K parties to interact. This total-user capacity result is distinct from the matched active-party latency above.

• Contract examples extend the test

  To test workloads with computation before decryption, the authors implemented four confidential smart-contract programs: an auction, token transfer, dark-pool exchange, and median oracle. The reported threshold-reveal time includes public preprocessing, partial decryption, and combination; across these examples it stayed below 1.2 seconds even at K=512.

  Correctness depends on each program’s stated input bounds, so these measurements show reveal costs for those examples rather than every contract.