The key that is nowhere
A radio's identity seed is split across the other radios in its formation. To sign it must assemble a quorum that is actually present, and it holds the reconstituted seed for one operation before wiping it. A captured radio cannot even read its own message history.
- For
- Signals branches, COMSEC authorities
- Replaces
- Fill devices, KEK hierarchies, net-wide re-key drills
- Removes
- The long-term key on the device
- Root of trust
- Held by the customer
One captured radio should not mean a net-wide re-key
Today the private key is on the device. Encrypt it, wrap it in a TPM, demand a PIN: it is still there, so the adversary's best play is not cryptanalysis but capture. The response is a net-wide re-key measured in days and run under contact, which is exactly why units delay reporting a loss.
Sigilcore makes losing a radio one revocation entry plus one epoch refresh. In our assessment that single change is worth more to a signals branch than any cryptographic improvement, because it removes the reason to delay reporting.
Split
At enrolment the identity seed is Shamir-shared t-of-n across custodians in the formation, then wiped. No device holds it.
Assemble
To sign, the radio requests shares from custodians that are present. Only a quorum of current-epoch shares reconstitutes the seed.
Sign and wipe
The seed exists in memory for one operation, then is overwritten. The vault key for message history is quorum-derived the same way.
Refresh
Every epoch each custodian deals a fresh sharing of zero. The secret is unchanged; every share becomes new, so slow capture campaigns gain nothing.
What the formation gets
Inert on capture
Powered on, with the real passphrase, the device still holds nothing usable: the key material is in other rucksacks.
Patience stops working
An adversary must take t custodians inside one epoch. A radio a month for a year yields twelve shares that never combine.
Duress is expressible
A second credential opens a decoy corpus, revokes the node across its custodians and flags the net, while the captor sees a working radio.
Revocation, not re-key
Losing a radio is one revocation entry and one epoch refresh. Nothing else in the net changes.
Customer-held roots
Enrolment authority, PKI and every key ceremony belong to the customer. Irythra holds no master key.
One piece of hardware
The single sovereign root of trust in the stack, so the supply chain to establish is one component.
Technical summary
| Identity | Ed25519 / ML-DSA-87 signing seed |
|---|---|
| Sharing | Shamir t-of-n over GF(2⁸); threshold and formation size set by doctrine |
| Refresh | Proactive, per epoch; stale shares do not combine |
| Duress | Second credential: decoy corpus, silent revocation, net flag |
| Isolation policy | SOLO_GRACE_EPOCHS 0–3: bounded, logged, self-expiring |
| Status | Protocol real Hardware not started |
The cost, stated plainly
A radio genuinely cut off from its formation cannot originate traffic. The mitigation is a bounded solo grace period: zero for strategic nets, two or three for dismounted infantry who routinely lose contact. A radio cannot tell isolation from capture, so a captured radio inherits that same window.
And taking t custodians inside one epoch, as a section-level ambush might, compromises the identities they hold shares for. Formation size and threshold are doctrine decisions, and we would rather argue them in a trial than default them quietly.
Where Sigilcore fits
Tactical networks
Capture, jamming and DF for signals branches and dismounted sections.
Learn more ProfileQuorum Lace / UAS
Aircraft as each other's custodians; capsules signed by a quorum-bound identity.
Learn more ProductIrythra Watch
Custody state and duress flags for the whole fleet, without key material.
Learn moreThe binding constraint is a signals regiment willing to run a trial.
Not capital. If you can open that door, or want the architecture note and the runnable prototype to take apart yourself, we would like to hear from you.