The message that is on no link
There is no primary link to jam. Every message is sealed, split into shards (any k of n rebuild it) and sprayed across every available bearer at once, with a hard per-bearer cap so no single path ever carries a reconstructable set.
- For
- Integrators, radio OEMs, DPSUs
- Delivered as
- SDK on the radios a unit already has
- Bearers
- CNR · LTE/5G · LEO · mesh · LPWAN
- Per bearer
- 0 bits of the message key
One primary, one fallback, then silence
Tactical links fail cliff-edged. Jamming forces the fallback, then forces silence. And every channel recorded today is a live target for a decrypt in 2040, because SIGINT is archival.
Driftwell removes the link as a target. Losing bearers degrades delivery continuously and, above the threshold, not at all. Because the bearer is never trusted, a compromised civilian bearer is not a compromise. That is the commercial unlock: traffic can ride the networks that are actually there.
Seal
The message is encrypted under a fresh 256-bit key with ChaCha20-Poly1305, inside the end-to-end hybrid post-quantum session.
Disperse
The ciphertext is Reed–Solomon coded into n fragments; any k rebuild it exactly. The code is MDS: any k, not k with high probability.
Share the key
The message key is Shamir-shared k-of-n across the same shards. Fewer than k shards carry zero information about it.
Spray
The scheduler places shards on every bearer, capped at k−1 per bearer, weighted by capacity and exposure.
What the network gets
Jam-tolerant by construction
Delivery holds while any k shards arrive, on any mix of bearers. No failover, no reconnection, no retransmit.
Zero bits per bearer
An interceptor below threshold has no information about the key, information-theoretically; what remains is ciphertext under a 256-bit cipher.
Quantum-resistant at two levels
Hybrid ML-KEM-1024 + X25519 session keys, and below threshold a symmetric layer that does not depend on key exchange at all.
Cannot be misconfigured
The per-bearer cap of k−1 is enforced in the scheduler, not left to tuning.
Tamper-evident
Every shard set is authenticated; a corrupted shard is detected, not silently accepted.
Rides existing radios
An SDK for OEMs and DPSUs. Adoption does not require replacing a radio fleet.
Technical summary
| Coding | Non-systematic MDS Reed–Solomon over GF(2⁸); any k of n |
|---|---|
| Below threshold | Per-message key Shamir-shared k-of-n (Krawczyk, "secret sharing made short") |
| Session layer | Hybrid ML-KEM-1024 + X25519; ChaCha20-Poly1305 |
| Scheduler | Per-bearer cap k−1; capacity- and exposure-weighted |
| Bearers | Combat-net radio, LTE/5G, LEO satcom, Wi-Fi mesh, LPWAN |
| Status | Dispersal real · tested ML-KEM sized stub |
The limit, stated plainly
The per-bearer cap defeats an adversary on one bearer. An adversary who intercepts two or more bearers can collect k shards; for that adversary dispersal adds nothing, and the end-to-end hybrid session layer carries the whole weight. Bearers differ in how easy they are to intercept, so the cap is weighted by exposure, not only capacity.
Enumerating the available bearers is itself an observable act on some of them. That one is open.
Where Driftwell fits
The binding constraint is a signals regiment willing to run a trial.
Not capital. If you can open that door, or want the architecture note and the runnable prototype to take apart yourself, we would like to hear from you.