Sealing & the Lock

§S1 The problem with time

A vault that should open in 2400 has to survive the fact that no cipher can read a calendar. There are three known ways to send a secret into the future. A trusted keeper can hold the key and release it on the day — but keepers die, merge, are subpoenaed, and lose things. A key can be made merely expensive to guess — but guessing parallelises, so the delay is a function of the attacker’s budget, not of time. Or the key can be placed at the end of a long computation that is inherently sequential, where each step needs the result of the step before and a thousand machines are no faster than one.

Afterberry uses the third. The construction is the time-lock puzzle of Rivest, Shamir and Wagner (Time-lock puzzles and timed-release crypto, MIT/LCS/TR-684, 1996): repeated squaring modulo a number whose factorisation nobody knows.

There is one full-scale precedent. In 1999 Rivest sealed the LCS35 time capsule behind 79,685,186,856,218 squarings of a 2,048-bit modulus, sized to take about 35 years. It was solved in April 2019, fifteen years early: Bernard Fabrot had run the squarings on one ordinary CPU core for three and a half years, and a team using a purpose-built FPGA design reached the same answer in about two months. Nothing was broken except the forecast. A time-lock measures work, not time, and the honest way to specify one is to state the work, state the assumption that converts it to years, and show what happens when the assumption is wrong (§S4).

§S2 The lock — profile AB-L1

Safe primes (p = 2p′ + 1 with p′ prime) leave the group of squares modulo n with no small subgroups, which the relay proofs of §S5 rely on. The base is derived by hashing so that nobody, the maker included, chooses it. Values are compared in canonical form because z and n − z have the same square; the chain itself is ordinary squaring.

Eight thousand bits is larger than present practice requires. The largest modulus of this kind factored in public is RSA-250, at 829 bits, in 2020. The margin is there because the lock has to stay shut against classical mathematics for four centuries, and the cost of the margin — some hours of prime-hunting at the ceremony and a slower squaring for everyone afterwards — is cheap.

§S3 Two doors

The patient door. Without the factors of n, the only known way to reach x^{2^t} is to perform t squarings one after another. Parallel hardware makes each squaring faster up to a point — a wide multiplier instead of a narrow one — but cannot overlap them. That this has no shortcut is an assumption, not a theorem. It has stood since 1996, and close relatives of it now underpin deployed verifiable-delay functions, but it is listed among the vault’s assumptions in §S9, where it belongs.

The capability door. With the factors, φ(n) = (p − 1)(q − 1) is known, the exponent collapses to e = 2^t mod φ(n), and y = ⟨x^e mod n⟩ is one short exponentiation. Classically, factoring 8,192 bits is out of reach by an absurd margin. Quantumly it is an engineering programme: Shor’s algorithm needs a number of logical qubits roughly proportional to the length of n and a gate count roughly proportional to its cube. Gidney’s 2025 estimate for 2,048 bits is under a million noisy qubits and under a week. For 8,192 bits that becomes a machine a few times larger running some sixty times longer — a bigger machine, not a different kind of machine.

The doors cannot be separated. The maker needs a shortcut to build the lock at all — nobody can afford to perform 10¹⁹ squarings in order to seal a vault — and any group in which the maker has a shortcut is a group with a trapdoor. A trapdoor is a second door. Afterberry does not hide this; it addresses it. The maker walks through the capability door once, at the ceremony, to compute the four waypoint values, and then destroys the primes. From then on the second door is open only to something that can factor n without her.

§S4 Waypoints, rings, and the conversion to years

The lock’s reference rate is 10⁹ squarings per second. Each waypoint exponent is the number of seconds from the ceremony to its target date, times 10⁹, and is fixed at the ceremony — nobody can begin squaring before n exists. The figures below are computed from 2 September 2026, 00:00 UTC, the day the 8,888th founding photograph entered the register; every day between then and the ceremony takes 8.64 × 10¹³ off each of them.

The waypoints lie on one chain, so reaching Ring II means having passed Ring I. Exponents are carried as 16-byte integers and written in the lock file as decimal strings: the largest already exceeds what a signed 64-bit integer can hold, or a floating-point number can hold exactly.

What the reference rate means in years depends entirely on how fast one 8,192-bit modular squaring can be made to go:

The latency of a squaring is bounded below by the depth of a multiplier, which grows with the logarithm of the operand length; nobody knows how low engineering can push it. One nanosecond, for an operand four times the length of LCS35’s, is a deliberate bet that sequential arithmetic has about one order of magnitude left in it beyond what was already on the drawing board in 2020. If that is too pessimistic, the patient door is reached before 2400 by whoever builds the faster machine and keeps it running for decades. If it is too optimistic, the patient door is late, and the vault waits — which it was always prepared to do. The work done on slow hardware is never wasted: it carries forward to the fast hardware that replaces it.

The waypoints stage only the patient door. The capability door opens all four rings in the same afternoon. The rings are therefore not four levels of secrecy; they are four instalments of one letter, and what may not be read early belongs in the Remainder (§S7).

§S5 The relay

No person, and probably no institution, will perform 10¹⁹ squarings alone. The patient door is built to be walked in relay. A runner starts from the latest published checkpoint x_j, squares for as long as they are able, and publishes x_j+T with a proof that it is correct, so that the next runner need not trust them or repeat their leg.

The proof is Wesolowski’s (Efficient verifiable delay functions, EUROCRYPT 2019). For a leg claiming b = ⟨a^{2^T}⟩:

Verification costs two small exponentiations however long the leg was. Producing the proof costs about as much again as the leg, but unlike the leg it parallelises. Its soundness rests on the difficulty of extracting chosen roots modulo n, and on nobody being able to find an element of low order other than ±1 — which would amount to factoring n. The chain itself lives among the squares, which with safe primes have no such elements at all; the canonical form disposes of −1. The reference tool tests ℓ for primality by Miller–Rabin to the first 64 prime bases, which is adequate only because every candidate is a hash output and not an adversary’s choice.

The proofs are sound against anyone who does not hold the factors. Someone who does can forge one — and has no need to, since they can open the lock outright; but they could feed the relay a false checkpoint out of malice. So the lock file also carries 8,888 milestones: SHA-256(“afterberry/AB-L1/milestone/” ‖ j as two bytes ‖ ⟨x_j·m⟩) for j = 1…8,888, with m = ⌊t₄ / 8,888⌋ — one about every fifteen days at the reference rate (every forty-six days at 3 ns, every two and three-quarter years at 65 ns), computed by the maker at the ceremony at the cost of an exponentiation each. A reader derives m from t₄ and does not take it from the file. A false checkpoint survives until the next milestone and no further. Milestones and arrival checks are conveniences for the runners; the final test of a waypoint value is that it unwraps a sealed key, which no one can fake.

A checkpoint is a small thing: a position on the chain, a value, a proof, a date, a name. The relay log is a chain of them. Anyone can audit it from the beginning in minutes. No one has to finish what they start.

§S6 From waypoint to plaintext — profile AB-E1

A waypoint value is not itself a key. Keys are derived from it, and they unlock keys, not data, so that the sealed material never has to be re-encrypted and each capsule stands alone.

The header core binds every chunk to its capsule and to this lock:

A capsule’s ciphertext is the run of chunk records and nothing else. A capsule file is header core ‖ W_c ‖ ciphertext; that is the form in which the rehearsal capsules are published. In the vault proper the ciphertext is split into shards, and every shard’s header repeats the core and W_c (Preservation §R3).

Because chunks are authenticated independently, damage stays where it falls: a capsule with a hole in it still yields every chunk around the hole. A reader opening a whole capsule must check that the number and length of its records agree with the plaintext length in the header, and that only the last carries the final flag; then a truncated capsule cannot pass for a complete one. An empty capsule is one empty record with the flag set. All integers are big-endian.

§S7 The Remainder

A Remainder capsule is sealed exactly as above with one omission: its content key is never wrapped. It is generated, used, verified, and destroyed. There is no W_c, no waypoint, no door.

What would it take to open one? No attack on AES-256 meaningfully better than searching for the key is known, and the search is not a matter of better computers. Counting through 2²⁵⁶ keys, at the thermodynamic minimum for an irreversible bit operation in a three-kelvin universe, would consume roughly 3 × 10⁵⁴ joules, the entire output of the Sun for about 3 × 10²⁰ years. Grover’s algorithm reduces the count to 2¹²⁸ quantum iterations, which must run one after another; at a nanosecond each that is 10²² years. The Remainder opens only if AES-256 turns out to have a structural flaw that nobody has found since 1998.

The rule for what goes there is simple. Ring IV is aimed at 2400 but defended by an engineering forecast about quantum computers, and forecasts fail early. The Remainder is defended by the size of a number. Anything that could wound a person still living on the day the capability door opens — whenever that is — goes to the Remainder, and Berry has accepted that it will almost certainly never be read. Which capsules are which is fixed at the ceremony and visible in every header.

§S8 The ceremony

The vault is sealed once, in a single witnessed ceremony. Until then the archive is a working collection in the maker’s ordinary custody and nothing in it is described here as sealed.

The ceremony follows a published script, read aloud step by step, with deviations recorded rather than smoothed over. It runs on one machine that has never been networked and has no persistent storage, booted from read-only media whose digest is published beforehand. In outline:

1. Entropy. Operating-system randomness, a hardware generator, and dice thrown by each witness — out of sight of the cameras and of one another, typed in directly, never written down — are hashed together. The pool is unpredictable if any one source is both honest and unobserved.
2. The lock. Generate p and q; form n; derive x; compute the four waypoint values and the 8,888 milestones through the capability door; publish the arrival checks, the milestones and the lock digest.
3. The capsules. For each of the 101: draw a content key, encrypt, and — for ring capsules — wrap the key. Remainder keys are dropped here.
4. Proof of work done. Re-open every ring capsule through the capability door from the published parameters alone, and compare digests with the plaintext, before anything is destroyed.
5. Coding and carriers. Split each capsule into 88 shards; build the 8,888 records; embed them; extract every one back out of its finished carrier.
6. Signature. Generate the maker’s signing keys on the same machine; sign the lock file, the capsule inventories and the carrier catalogue; export the public keys with the outputs (Preservation §R7).
7. Export. Write the public outputs to write-once media. Nothing else leaves the machine.
8. Destruction. Power off. Remove and physically destroy the memory modules and the boot media. The primes, the waypoint values, every ring key and content key, and the maker’s signing key existed only there.
9. Attestation. Each witness signs a statement of what they saw. The script, the log, the recordings, the media digests and the statements are published together.

Destruction cannot be proved. It can only be witnessed, and the witnessing can be made expensive to fake. That is the same bargain struck by the Zcash parameter ceremonies of 2016–18 and by the DNSSEC root key ceremonies held every quarter since 2010, and it is the reason for the script, the witnesses, the dice and the hammer.

A later profile may generate n jointly among several parties (Boneh and Franklin, Efficient generation of shared RSA keys, CRYPTO 1997), so that no single machine ever holds the primes and the maker leaves the trust base altogether. The single-machine ceremony is the adopted design.

§S9 Assumptions, stated

Every one of these is a way the vault could open early. None is a way it could fail to open late; only loss does that, and loss is the business of Preservation.

1. Sequentiality. Repeated squaring modulo n has no shortcut without the factors. If it has, the patient door opens early.
2. Classical factoring. Factoring 8,192-bit moduli stays infeasible for classical machines through 2400. If not, the capability door opens to less than was intended.
3. The reference rate. One 8,192-bit squaring takes about a nanosecond or longer for most of the next four centuries. §S4 shows what each wrong guess costs.
4. The symmetric layer. AES-256 and SHA-256 hold. If AES-256 breaks, everything opens, the Remainder included. If SHA-256 weakens, the integrity anchors weaken with it — though not the confidentiality — which is why the inventories and the catalogue record every file digest under SHA3-256 as well.
5. The ceremony. The primes and keys were in fact destroyed. This is the only assumption about people, and the only one that cannot be tested afterwards.

§S10 The rehearsal set

The rehearsal is the ceremony software run at a survivable scale with the one difference that matters: the primes are kept and published. It protects nothing. It exists so that the mechanisms on this page can be run rather than believed: both doors, the milestones, the relay proofs, the sealed keys and the chunk decryption. Multi-chunk capsules — the chunk counter, the final flag, a dropped or reordered record — and the Remainder form are exercised by the self-test on throwaway data.

The lock file is JSON: lock_id, bits, n_hex, x_hex, lock_digest_sha256; waypoints, each with ring, t (a decimal string) and check_sha256; milestones, with interval and the list checks_sha256. The rehearsal file adds capsules and, under rehearsal_only, everything the real file will never contain.

Both doors print the same four sentences. File digests are listed in Status §T3. The vault panel on the front page runs the same lock in a browser: the human pathway squares, the other pathway asks for the factors.