Three bets, all now losing
Every fielded COMSEC system makes the same three bets: that the key on the device can be kept secret, that the link can be kept open, and that a box at the boundary can decide what crosses it. In contested spectrum against a peer adversary, all three bets are now losing.
The evidence is not theoretical. In Ukraine the decisive electronic-warfare lesson was not that traffic was read. It was that emitters were located and shelled. Meanwhile units unable to distribute encryption keys fast enough fell back to civilian handhelds; the COMSEC failure was a logistics failure, not a cryptographic one.
Neither problem is solved by better encryption. Both are addressed by changing what exists.
Nothing whole
No bearer, relay or captured device holds a reconstructable copy of anything. A bearer carrying fewer than k shards carries zero information about the message key.
Nowhere resident
No long-term private key exists on any device at rest. Capture is inert on capture: no zeroization race, no dependency on the loss being reported.
No one trusted
Not the network, not the bearer, not the vendor. We hold no master key and cannot decrypt customer traffic under any circumstance, including legal order.
What actually happens to a section under EW
The threat model is written from the adversary's side, because that is the only side that matters. Each row is an attack that works today against systems in Indian service.
| Adversary action | Why it works today | What changes | Layer |
|---|---|---|---|
| Capture one radio intact | The private key is on the device. Encrypt it, wrap it in a TPM, demand a PIN: it is still there. Response is a net-wide re-key measured in days, run under contact. | The device holds no usable secret. Identity is reconstituted only from a quorum of the formation, and only for the duration of one signature. | Sigilcore |
| Direction-find the emitter | Encryption hides content, not emission. Continuous C2 and voice nets radiate continuously; the command post is the loudest node on the net. | Reduced, not removed. Transmission timing stops revealing tempo, and the scheduler moves traffic onto low-emission bearers as DF risk rises. Emission itself is a budget to manage, not a problem cryptography solves. | Saelvor |
| Jam the tactical band | One primary link, one fallback. Jamming forces the fallback, then forces silence. Failure is cliff-edged. | There is no primary link. Shards ride every bearer at once; losing bearers degrades continuously and, above the threshold, not at all. | Driftwell |
| Record now, decrypt later | SIGINT is archival. Traffic recorded in 2026 is still a live target in 2040, and strategic traffic has a 30-year secrecy horizon. | Hybrid ML-KEM-1024 + X25519 session keys survive if either primitive holds. Below that, an intercepted bearer carries fewer than k shards and so zero information about the per-message key. | Driftwell |
| Traffic analysis | Untouched by any cipher. Volume rises before every operation; the node everyone talks to is the CP. Order of battle falls out of the metadata. | Every node emits an identical constant stream of identical frames, real or chaff, indistinguishable without the session key. | Saelvor |
| Coerce the operator | A correct passphrase is a correct passphrase. There is no way to comply and signal simultaneously. | A duress credential opens a decoy corpus, revokes the node across its custodians, and flags the net, while the captor sees a working radio. | Sigilcore |
| Spoof a swarm member | Swarm membership is arbitrated by the ground station. Jam the GCS and the swarm fragments or accepts anything. | Aircraft are each other's custodians. Admission and expulsion need a quorum of airframes and rotate the epoch, killing replayed identities. | UAS |
| Exploit the cross-domain guard | An accredited box on the boundary is a chokepoint, a single point of compromise, and a procurement item measured in crores and years. | The release decision moves into the ciphertext. Each field carries its own release policy; there is no box in the middle to capture. | Release |
Three things removed
The architecture is best understood by what is absent from it. The diagram below is the same tactical exchange drawn twice: what a conventional encrypted net gives an adversary, and what remains after the key, the link and the guard are removed.
The key that is nowhere
A node's identity seed is split t-of-n across the other nodes in its formation. The node itself holds nothing usable. To sign or decrypt it must assemble a quorum that is actually present, and it holds the reconstituted seed only for the duration of the operation before wiping it.
A captured device is cryptographically inert at the moment of capture. There is no race against zeroization and no wait for the loss to be reported up the chain, because the quorum is simply no longer there to answer. It cannot even decrypt its own message history: the vault key is quorum-derived too.
Losing a radio stops being a net-wide re-key and becomes one revocation entry plus one epoch refresh. In our assessment that single change is worth more to a signals branch than every cryptographic improvement on this page combined, because it removes the reason units delay reporting a loss.
Patience stops working
Shares are re-randomised every epoch by proactive refresh: each custodian contributes a fresh sharing of zero, so the secret is unchanged while every share becomes a new random value. An adversary must therefore compromise t custodians inside a single epoch. Capturing one radio a month for a year yields twelve shares from twelve epochs that cannot be combined.
The corollary is stated rather than hidden: taking t custodians inside one epoch, as a section-level ambush might, is a compromise of the identities they hold shares for. Formation size and threshold are therefore doctrine choices, made with the signals branch.
Duress is expressible
A second credential opens a decoy corpus, revokes the node across its custodians, and flags the net, silently. From the captor's point of view the coercion succeeded and the radio works, which is precisely the objective.
The cost, stated plainly
A node genuinely isolated from its formation cannot originate traffic. This is a real operational limit, not a rough edge. The mitigation is a bounded, logged, self-expiring solo grace period (SOLO_GRACE_EPOCHS): zero for strategic nets, two or three for dismounted infantry who routinely lose contact. A node cannot tell isolation from capture, so a captured radio inherits that same window. This parameter is a doctrine decision for the signals branch, and we would rather argue about it in a trial than default it quietly.
The message that is on no link
Each message is sealed under a fresh 256-bit key with ChaCha20-Poly1305. The ciphertext is Reed–Solomon coded into n fragments, any k of which reconstruct it exactly. The key itself is Shamir-shared k-of-n across the same shards. The shards are then sprayed across every available bearer simultaneously: combat-net radio, a commercial LTE SIM, a LEO terminal, a Wi-Fi mesh, a LoRa module.
The code is MDS: the k source blocks are coefficients of a degree-(k−1) polynomial and each fragment is that polynomial at a distinct point, so any k evaluations determine it uniquely. That is not "k with high probability"; it is any k, verified in the reference engine over 300 random subsets.
Why an intercepted bearer yields nothing
Erasure coding alone is built for availability, not secrecy: k−1 fragments leave one unknown symbol per byte position, so structure in the plaintext could fill the gap. That is why the construction does not rely on it. The confidentiality below threshold comes from the key share. With fewer than k shares of a Shamir sharing, every possible key remains equally consistent with what the interceptor holds. That is information-theoretic: it does not depend on computation. What remains is ciphertext under a key the interceptor knows nothing about, protected by a 256-bit symmetric cipher, which already holds against a quantum adversary without relying on the key exchange. This construction is Krawczyk's "secret sharing made short".
That property is the commercial unlock. It is why traffic can ride a civilian SIM: the bearer is not trusted, so a compromised bearer is not a compromise. The scheduler enforces it structurally, with a per-bearer shard cap hard-limited to k−1, so the system cannot be misconfigured into putting a reconstructable set on one path.
The limit, stated plainly
The per-bearer cap defeats an adversary on one bearer. An adversary who intercepts two or more bearers can collect k shards, and for that adversary dispersal adds nothing; the end-to-end hybrid session layer carries the whole weight. Bearers also differ in how easy they are to intercept, so the scheduler should weight the cap by exposure, not only by capacity.
The attack encryption does not touch
An adversary who cannot read one word of your traffic can still read your intentions from its shape. Volume, timing and who-talks-to-whom are protected by no cipher. Brigade traffic rises before an operation, every time. The node everyone talks to is the command post, and it is worth a missile.
This is not a subtle side channel. It is how order of battle has been derived from signals intelligence since 1914, and it is the entire reason EMCON exists as a doctrine. Encrypting harder does nothing at all: the metadata is in the envelope, not the letter.
Saelvor emits at a constant rate, always. Every node produces an identical stream of identical 256-byte frames whether it is carrying an operations order or nothing. Real traffic rides inside and chaff rides otherwise, both as AEAD output under the same key schedule; the two are computationally indistinguishable without the session key.
The cost, stated plainly
Constant-rate emission costs bandwidth and battery continuously, at ≈4.8× for full cover of a brigade's tempo. It also raises the DF floor, because you are always transmitting. Constant rate defeats traffic analysis; it does not defeat direction-finding, and transmitter fingerprinting can still tell radios apart. It is worth paying only adaptively: full cover when the EW picture is hot, degraded when bandwidth is scarce, with chaff placed on cheap low-emission bearers. The adaptation itself must not track operational tempo, or the rate change becomes the signal. Anyone claiming metadata privacy without this cost is not providing it.
The guard that is not a box
Moving a target coordinate from a SECRET Indian feed to a coalition partner today requires an accredited hardware guard on the boundary. Those boxes cost crores, take years to accredit, become a chokepoint at exactly the moment of crisis, and concentrate risk.
Worse, they force a whole-document decision at the boundary, so the usual outcome is that the document is withheld and a staff officer retypes one grid reference into a chat window. That human is the real cross-domain solution in service today, and they are slow and they make mistakes.
Release stops guarding the boundary and makes the data self-guarding. Each field is sealed under its own boolean policy over clearance attributes. One artifact travels everywhere unchanged, and each recipient's key ring opens exactly the fields their attributes satisfy.
Construction, and its honest limits
This is a symmetric-key realisation of a CP-ABE access structure by linear secret sharing: OR replicates a share, AND splits it n-of-n, and k-of-n uses Shamir. That last gate matches how release authority actually works on a staff ("any two of BDE COMD, BDE 2IC, duty officer"). Every slot is padded to the same shape, so invisible fields cannot be counted.
The trade is deliberate. For a national deployment where the authority is the MoD and principals are enrolled devices, a symmetric single-authority construction is the right one. It has limits we state up front:
- Whoever seals to a policy holds that policy's attribute keys, so sealing devices need the same custody discipline as Sigilcore.
- Collusion resistance has to come from binding attribute keys to their principal at issue, not from pairing-based algebra.
- For genuine multi-authority coalition federation it is the wrong construction, and we would use a pairing-based scheme there instead.
- Releasing the ciphertext of a field to a partner who cannot open it is still releasing ciphertext. For fields with a long secrecy horizon, policy may require that partner copies omit them entirely.
The drone off the leash
A continuously-commanded drone needs a link that is simultaneously jam-resistant and quiet, and the ground control station radiates continuously, which is exactly how GCSs are located and struck. Every minute of link is a minute of exposure for the operator.
UAS replaces the leash with an intent capsule: a signed, time-boxed, geofenced, ROE-constrained authorisation to act autonomously. The GCS transmits once and goes quiet. Link loss stops being a failure mode and becomes the designed steady state.
Every constraint is enforced by the aircraft, not by operator discipline. An expired capsule, a geofence exit, or a signature that is not from the quorum-bound identity all fail closed. Because the capsule is signed by a quorum-bound identity, a single captured staff tablet cannot task an aircraft at all.
The swarm authenticates itself
Aircraft are each other's custodians. Admission and expulsion require a quorum of airframes and rotate the swarm epoch, so a downed aircraft's replayed identity is rejected in flight with no ground link involved.
A record that survives a court of inquiry
Every command and sensor frame is hash-chained and signed. Altering any historical entry breaks every hash after it, and the head hash is witnessed by the formation, so even total compromise of the aircraft cannot rewrite history that has already been seen. After a strike goes wrong, the question "what was the aircraft told, and who authorised it?" has an answer that is defensible rather than merely asserted.
Why the MoD can trust a startup with this
This is the first objection in every meeting, and it deserves a structural answer rather than a reassuring one.
- We hold no master key. The attribute authority and the identity root are held by the customer. We cannot decrypt customer traffic: not under contract, not under legal compulsion, not under acquisition by a foreign parent. This is a property of the architecture, not a clause in an agreement.
- The customer owns every root of trust. The algorithms are published standards (ML-KEM-1024, ML-DSA-87, SLH-DSA, alongside classical X25519 and Ed25519), and the design accommodates nationally approved algorithms where they are required. The PKI, the enrolment authority and every key ceremony are the MoD's.
- Auditable. Reproducible builds and full source under escrow and NDA for DRDO and the designated evaluation authority. The architecture is deliberately small enough to be read.
- A small hardware surface. Everything but the Sigilcore root of trust is software, so the supply chain to defend is one component, not a radio fleet. Endpoints are COTS, and an endpoint compromise sees plaintext; that risk is managed by device hardening and attestation, not wished away.
- Hybrid, not fashionable. Session keys are secure if either the lattice or the classical primitive holds. Indian strategic traffic has a secrecy horizon longer than any credible estimate of time-to-CRQC, so hybrid is the only defensible choice.
What is real, and what is not
A customer will ask, and the answer should be volunteered rather than extracted. The component-by-component status, the open problems we have not solved, and the kill criteria for each phase are on one page.
Status, open problems and kill criteria
Prepared as a concept document. Not a legal, export-control or accreditation opinion. Company and product names require formal trademark clearance in classes 9, 38 and 42 before use.