Driftwell sends every message across every bearer a unit carries: combat-net radio, a commercial SIM, a satellite terminal, a mesh. It splits each message into n shards such that any k of them rebuild it. Two bearers jammed, one tapped, and the message still arrives.
A natural assumption is that this splitting also provides secrecy: if an interceptor on one bearer holds fewer than k shards, surely they have nothing. That assumption is wrong for the most common way of splitting data, and getting it right is the difference between a real guarantee and a marketing claim.
What Reed–Solomon coding does
Reed–Solomon codes are built for availability. The message is cut into k blocks, which become the coefficients of a polynomial of degree k−1. Each shard is that polynomial evaluated at a distinct point. Because a polynomial of degree k−1 is fixed by any k of its values, any k shards rebuild the message exactly. Codes with this property are called MDS, and the guarantee is not "k with high probability" but any k.
Why k−1 shards are not nothing
Each shard is a linear combination of the k message blocks. An interceptor with k−1 shards therefore holds k−1 linear equations in k unknowns at every byte position. That leaves one unknown symbol per position, not "every possible message equally consistent".
The difference matters as soon as anything about the message is known. A fixed header, a standard report format or zero padding in the last block supplies the missing equation, and then the whole message falls out. Our test suite includes exactly this case: with k = 4, three shards plus one known block recover the full message. Erasure coding on its own leaks most of the structure of what it carries.
Erasure coding decides who can rebuild a message. It does not decide who can read it.
The construction Driftwell uses
The fix is old and well understood. Hugo Krawczyk described it in 1993 as "secret sharing made short":
- Encrypt the message under a fresh, random 256-bit key with an authenticated cipher (ChaCha20-Poly1305).
- Erasure-code the ciphertext into n fragments, any k of which rebuild it.
- Shamir-share the key k-of-n across the same n shards, so each shard carries one fragment and one key share.
Shamir sharing has the property erasure coding lacks. With fewer than k shares, every possible key remains exactly as likely as every other. That is information-theoretic: it does not depend on how much computation the interceptor has. What remains in their hands is ciphertext under a key they know nothing about, protected by a 256-bit symmetric cipher. Even a quantum adversary's best generic attack, Grover's search, leaves a 256-bit key with roughly 128 bits of security, so this layer does not depend on the post-quantum key exchange at all.
Driftwell's scheduler then enforces a hard per-bearer cap of k−1 shards. No single bearer can carry a reconstructable set, and the system cannot be misconfigured into putting one there.
What it does not cover
Two limits are worth stating as clearly as the guarantee.
An adversary on two bearers can collect k shards. The per-bearer cap defeats an interceptor on one bearer. For an adversary who taps several, dispersal adds nothing, and the end-to-end hybrid session layer (ML-KEM-1024 with X25519) carries the whole weight. That is why both layers exist.
Short messages pay for the key shares. Every shard carries a 32-byte key share. A 64-byte contact report spread over 20 shards puts roughly 900 bytes on the air, about fourteen times the message. For longer traffic the overhead falls towards n/k. Radio budgets have to account for it honestly.
Try it
The dispersal module in our reference lab runs this construction in your browser. Jam bearers, intercept one, and the interceptor panel shows that 256 of 256 values remain possible for every byte of the key. Then intercept a second bearer and watch the guarantee end, as it should.