Dispersed-trust communications for contested spectrum

Nothing whole. Nowhere resident. No one trusted.

Every secure radio in service bets that its key stays secret, its link stays open and a box can guard the boundary. Against a peer adversary all three bets are losing. Irythra does not harden the key, the link or the guard. It removes them.

Live · one message · five bearers · two jammed · one intercepted Computed in your browser by the reference engine
Static figures · enable JavaScript to compute them live
0 bits
of the message key in an intercepted bearer carrying 5 of the 8 shards needed.
14/20
shards arriving with two of five bearers jammed. Eight were needed. No retransmit, no failover.
+0.000
correlation between operational tempo and what an observer sees. A conventional net scores +1.000.
4.8×
bandwidth cost of full metadata cover for a brigade's tempo. Stated because it is real.
The problem

Every COMSEC system in service makes three bets. All three are now losing.

Bet 01

The key stays secret

It is on the device. Encrypt it, wrap it in a TPM, demand a PIN: it is still there. One captured radio, and the response is a net-wide re-key measured in days, run under contact. So units delay reporting the loss.

Bet 02

The link stays open

One primary, one fallback. Jamming forces the fallback, then forces silence. And a link that stays open keeps radiating, with its volume, timing and who-talks-to-whom on display.

Bet 03

A box can guard the boundary

Cross-domain guards cost crores, accredit in years and become the chokepoint at H-hour. So staff officers retype grid references into chat, and that person becomes the real cross-domain solution.

Ukraine settled an old argument. Direction-finding, integrated into fires, turned transmissions into targeting cues. A radio that is perfectly encrypted and perfectly locatable is a beacon that kills its operator.

And units that could not distribute keys fast enough fell back to civilian handsets: a logistics failure, not a cryptographic one. A stronger cipher fixes neither.

Why Irythra

Trust that is a property of the architecture, not a clause in a contract

We hold no master key

The identity root and attribute authority are the customer's. We cannot decrypt customer traffic under contract, legal compulsion or acquisition.

One root of trust

Everything but Sigilcore is software. The supply chain to establish is one component, not a radio fleet.

Overlay, not rip-out

Quorum Lace rides the bearers a unit already carries. Adoption does not require replacing a radio fleet.

Status volunteered

What is real, what is a stub and what would prove us wrong are published, not extracted in a meeting.

Path to fielding

What we do next, and what would prove us wrong

iDEX is the door; DAP Chapter III is the room. Every phase has a kill criterion we would rather meet in a trial than in service.

Full plan
0–6 months

Certified crypto core

ML-KEM / ML-DSA through a validated module; formal model of quorum unlock and handshake.

Kill criterionQuorum latency cannot be made workable at message cadence.
6–12 months

Saelvor on issued COTS

Lab trial against a real EW team.

Kill criterionCover-traffic power cost is unsurvivable on a 72-hour dismounted battery.
12–18 months

Signals user trial

iDEX user trial with a signals regiment; UAS profile with a UAS unit.

Kill criterionOperators route around quorum identity in the field.
18–30 months

First order

Accreditation pathway, Release coalition pilot, first Chapter III order.

Kill criterionNo accreditation route for software-first COMSEC at the target classification.
Get in touch

The binding constraint is a signals regiment willing to run a trial.

Not capital. If you can open that door, or want the architecture note and the runnable prototype to take apart yourself, we would like to hear from you.