Threshold Private Synthesis · Shimmery Memory

Purpose

This note records the cryptographic substrate beneath Fractal Boundary Architecture.

The requirement is simple to state:

From a known universe of y distinct eligible pieces, allow some hidden subset of at least x pieces to contribute to a result, prove that the required conditions were satisfied, and reveal neither the private pieces nor which specific subset participated unless the output itself necessarily reveals them.

The result may be:

a reconstructed secret;
a signature;
an authorization;
a classification;
a score;
a statistical estimate;
a model update;
a state transition;
another encrypted object;
a new participant at the next compositional layer.

The substrate does not require the pieces to be held by people.

A piece may be controlled by a person, process, machine, organization, agent, aggregate, sensor, or some future bounded system.

The substrate does not assign semantic meaning to participation.

It establishes only cryptographic and procedural facts.

The distinction from ordinary threshold cryptography

Threshold cryptography usually begins with a secret or key deliberately divided among n parties so that some threshold t can perform a cryptographic operation.

For example:

t-of-n

participants may jointly produce a signature or decrypt a ciphertext while fewer than t cannot.

That primitive is useful here, but it is not the whole architecture.

Threshold private synthesis is more general.

The y pieces may be independently meaningful inputs:

K_1, K_2, …, K_y

and different valid subsets may produce different results:

R = F(K_i1, K_i2, …, K_im),   m ≥ x

The objective is therefore not only to protect a shared key.

It is to protect:

the contents of each contribution;
the identity or index of the participating subset;
optionally the identity of the contributors;
the intermediate computation;
optionally the output itself;
while still proving enough structure for the result to be externally usable.

This is a composition of cryptographic primitives rather than one primitive.

Objects

Let the eligible universe be:

𝒦 = {K_1, K_2, …, K_y}

Each piece K_i is represented externally by a binding commitment:

C_i = Commit(K_i; r_i)

where r_i is commitment randomness.

The public system may know the commitments:

𝒞 = {C_1, …, C_y}

without knowing the underlying pieces.

The commitments can be accumulated into a registry commitment:

R_𝒞 = Accumulate(C_1, …, C_y)

The implementation might use a Merkle root, cryptographic accumulator, vector commitment, or another authenticated-set structure.

The registry root is a compact commitment to the eligible universe.

It does not need to reveal which members later participate.

Hidden membership

For a contribution to count, the system needs to establish that it corresponds to one eligible registered piece without exposing which one.

A contributor therefore proves a statement of the form:

∃ i, K_i, r_i:
  C_i = Commit(K_i; r_i)
  ∧ C_i ∈ R_𝒞

The proof can be zero knowledge.

The verifier learns:

this input opens one valid registered commitment.

The verifier does not learn:

this is commitment C_37.

The exact proof system is an implementation choice.

The architectural requirement is hidden membership.

Distinctness without identification

Threshold satisfaction is meaningless if the same eligible piece can be counted repeatedly.

The computation therefore needs a way to prove:

i_a ≠ i_b

for every pair of participating pieces, without revealing the indices.

A practical construction can associate each registered piece with a scope-specific unlinkable nullifier:

N_i = H(scope ∥ s_i)

where s_i is secret material bound to the eligible piece and scope identifies the synthesis instance, epoch, or decision.

The contributor proves in zero knowledge that:

the nullifier was derived correctly from an eligible hidden member;
the hidden member satisfies the validity rules.

The system rejects duplicate nullifiers within the same scope.

Thus it can establish:

|{N_1, …, N_m}| = m

without learning which registered commitments generated them.

The scope matters.

A globally stable nullifier would create unwanted linkability across unrelated syntheses.

Private input transport

The valid contribution must then enter a computation without becoming visible to unauthorized participants.

Several implementation families are possible.

Secret-shared MPC

Each K_i is split into shares and distributed among an MPC committee:

K_i → (K_i^(1), K_i^(2), …, K_i^(q))

No single computation party need possess the plaintext input.

The committee jointly evaluates:

R = F(K_i1, …, K_im)

Security depends on the MPC protocol and its corruption threshold.

Threshold encryption

Inputs may be encrypted under a public key whose corresponding secret key is distributed among a threshold of parties.

No single party can decrypt.

A threshold coalition can perform an allowed decryption or related cryptographic operation.

Threshold encryption is useful when plaintext must eventually be recovered by an authorized quorum, but by itself does not provide arbitrary private computation.

Homomorphic computation

Inputs may be encrypted under a homomorphic encryption scheme.

Supported operations can be performed directly on ciphertexts:

Enc(K_1), Enc(K_2) → Enc(F(K_1, K_2))

Fully homomorphic encryption can, in principle, support general computation, but performance and system design may make MPC or hybrid approaches preferable.

Trusted execution

A hardware-isolated execution environment can also approximate the abstraction.

This changes the trust model substantially: privacy then depends on hardware, vendor assumptions, side-channel resistance, attestation, and operational integrity.

It should therefore be treated as a different implementation class, not cryptographically conflated with MPC.

Threshold evaluation

Inside the private computation, the substrate verifies:

m ≥ x

It may also verify additional structural predicates:

V(K_i) = 1

for every accepted contribution.

These predicates might establish only cryptographic validity.

They might also encode application-specific rules.

The substrate remains content-blind only to the extent that V itself is structural.

The private computation can then evaluate:

R = F(S)

where

S = {K_i1, …, K_im},   m ≥ x

The function F may be deterministic or randomized.

If randomized, the source and handling of randomness become part of the security definition.

Public proof envelope

A useful synthesis output is not merely R.

It is an envelope:

Ω = (
  R,
  π_membership,
  π_distinct,
  π_threshold,
  π_computation,
  Γ
)

where Γ contains public context such as:

registry root;
synthesis identifier;
epoch;
function identifier or code hash;
declared threshold;
output commitment;
applicable public parameters.

The proof objects need not literally be four separate proofs.

A single zero-knowledge proof may establish the conjunction:

all inputs are eligible
all counted inputs are distinct
m ≥ x
R = F(S)

The verifier learns that the relation is true without learning the hidden witness set S.

This is the core external interface.

What the public can know

A minimal public output might establish:

A valid hidden subset of at least x distinct eligible pieces was processed according to F, producing result R.

The public need not learn:

the values of the pieces;
which eligible pieces participated;
who supplied them;
their ordering;
individual weights;
rejected submissions;
intermediate states.

Not every deployment needs to hide all of these.

Privacy dimensions should be explicit rather than bundled under one word.

Optional hidden output

The result itself may remain private.

Instead of releasing R, the system may release:

C_R = Commit(R; r_R)

E_R = Enc_PK_next(R)

A zero-knowledge proof can establish that the hidden output was correctly computed.

This yields:

Ω_hidden = (C_R or E_R, π_correct)

The enclosing system can therefore accept a valid output without possessing its contents.

This is the point at which the substrate becomes recursively composable.

Recursive composition

Suppose a hidden group G produces result R_G.

The result can be wrapped as a new externally recognizable object:

P_G = (
  ID_G,
  C_R_G,
  PK_G,
  Π_G
)

where:

ID_G is a scoped identifier;
C_R_G commits to internal state or result;
PK_G exposes whatever cryptographic interface the next layer requires;
Π_G proves the structural conditions under which the aggregate is permitted to participate.

The aggregate can now enter another registry:

P_G ∈ 𝒦′

At the next scale, the enclosing computation need not know whether P_G represents:

one original input;
seven contributors;
a thousand contributors;
another threshold synthesis;
a federation of already-composed aggregates.

The outer layer interacts with the interface.

Thus:

{P_1, …, P_n} → P_G

and then:

{P_G, P_H, P_J, …} → P_K

This is the cryptographic form of recursive opaque participation.

Fractal Identity

The compositional consequence is not merely organizational.

It is an identity primitive.

A participant can be:

a whole at one boundary

and simultaneously:

an aggregate of hidden parts behind that boundary

The outer system does not need the inner identity graph.

It needs only enough continuity and proof to recognize the participant required by the present relation.

This makes identity recursively contextual.

A cryptographic aggregate can preserve internal plurality while presenting a coherent external interface.

The aggregate need not become globally transparent in order to become externally real.

Re-rooting

Because the architecture is relational, an internal participant need not be permanently absorbed into an aggregate.

Where the relevant key material, protocol state, and application semantics permit, a participant may establish another relation or become the root of a new aggregate.

Cryptographically this means that participation in one synthesis does not inherently require surrendering the participant’s root secret or all future signing/decryption authority.

Care is required.

Some constructions deliberately create shared secrets whose later use depends on the original group.

Others allow independent keys to remain independent throughout aggregation.

The desired topology must therefore be chosen before implementation.

Recursive composability is not automatic merely because a scheme uses a threshold.

Separation of key authority from semantic authority

Threshold keys can prove that enough key shares cooperated.

They do not prove why the cooperation was legitimate.

A zero-knowledge circuit can prove that an encoded predicate evaluated to true.

It does not prove that the predicate captures the right semantics.

An MPC protocol can preserve private inputs.

It does not determine whether the result should be trusted by an external participant.

Therefore:

cryptographic validity ≠ semantic legitimacy

The substrate should expose the former.

Participants and higher layers decide the latter.

This preserves the distinction between content-blind coordination and semantic witness.

Leakage is part of the interface

The substrate can hide the witness set used to produce a result.

It cannot guarantee that the result reveals nothing about that set.

Suppose:

R = F(S)

and only one possible S could have produced R.

Then R identifies S logically even if the cryptographic proof reveals zero additional information.

Other leakage channels include:

exact subset size;
timing;
network metadata;
abort behavior;
repeated queries;
differences between successive outputs;
uncommon threshold patterns;
public registry changes;
collusion among computation parties;
maliciously chosen inputs;
side channels;
implementation bugs.

A technically honest design therefore defines its leakage surface explicitly.

Zero knowledge protects the proof witness.

It does not erase information already encoded in public behavior.

Repeated-query attacks

Recursive systems are especially vulnerable to differencing.

If an observer sees:

R_1 = F(S)

and then:

R_2 = F(S ∪ {K_j})

the difference between R_1 and R_2 may expose information about K_j.

The same problem appears when small changes in hidden membership produce observable output changes.

Mitigations may include:

batching;
minimum cohort sizes;
query budgets;
randomized release;
differential privacy for statistical outputs;
output coarsening;
delayed publication;
hiding exact participation counts;
preventing adaptive probing.

These protections belong to the output policy rather than the cryptographic core.

Failure and abort

Private computation introduces another often-hidden semantic question: what happens when a valid result cannot be produced?

A participant may:

fail to submit;
submit malformed data;
disconnect;
refuse a protocol round;
cause a timeout;
intentionally abort after learning partial state;
collude with other participants.

MPC security definitions distinguish privacy and correctness from fairness and guaranteed output delivery.

A substrate specification must therefore state what is guaranteed under failure.

Possible guarantees include:

privacy despite abort;
identifiable abort;
threshold continuation despite some unavailable parties;
no output unless all required phases complete;
recoverable resumption;
publicly witnessed failure state.

“Threshold met” and “output guaranteed” are separate properties.

Threat model

No implementation is meaningful without a declared adversary.

At minimum, specify:

Corruption threshold

How many computation parties may collude before input privacy or key secrecy fails?

Malicious versus semi-honest behavior

Are parties assumed to follow the protocol while observing everything they can, or may they arbitrarily deviate?

Network observer

Can an adversary see submission timing, source addresses, message sizes, and routing?

Registry authority

Who can add, remove, suspend, or replace eligible commitments?

Setup assumptions

Does the system require trusted parameter generation, a trusted dealer, hardware roots, common reference strings, or distributed key generation?

Availability

Can an adversary deny service by withholding a threshold share or refusing an MPC round?

Long-term secrecy

What happens if keys are compromised years later?

Forward secrecy, proactive resharing, key rotation, and post-quantum assumptions may matter depending on the application.

The architecture is stable across these choices.

The security guarantees are not.

Minimal abstract protocol

The substrate can be compressed into seven stages.

Stage 1 — Register

Commit eligible pieces into a public or shared authenticated registry:

R_𝒞

Stage 2 — Proffer

A hidden eligible piece produces a scope-specific submission.

Stage 3 — Prove

The submission proves hidden membership and correct derivation of a distinctness token.

Stage 4 — Admit

The private computation validates eligibility, uniqueness, and any structural predicates.

Stage 5 — Synthesize

Once:

m ≥ x

evaluate:

R = F(S)

Stage 6 — Attest

Produce a proof envelope establishing the required facts without exposing S.

Stage 7 — Recompose

Reveal R, commit to it, encrypt it, or wrap it as a new participant for another synthesis.

Then the cycle can recur.

The composable implication

The deepest consequence is this:

A group does not need to expose its members or internal computation in order to become a cryptographically valid participant in another group.

That permits:

private parts → private synthesis → opaque whole → private synthesis → larger opaque whole

At every level, the enclosing system can verify only the invariants it needs.

This yields a different scaling law:

Scale by proofs and interfaces, not by inherited visibility.

The internal contribution graph can remain local.

The external participant can remain composable.

The resulting topology can recurse without requiring a final observer who holds every underlying piece.

What this substrate is not

Threshold private synthesis is not itself:

a voting system;
a governance model;
a moral framework;
a reputation system;
a blockchain;
an identity standard;
a consensus protocol;
an accountability system;
a guarantee of anonymity;
a guarantee of fairness;
a guarantee that an output is semantically correct.

It is a lower layer.

It provides a family of cryptographic operations from which such systems may be built.

The same substrate can support radically different semantics.

Technical correspondence with existing cryptography

The architecture does not require inventing every primitive from scratch.

Existing cryptographic families already provide major components:

secret sharing and threshold schemes distribute cryptographic authority;
secure multiparty computation evaluates functions over private inputs;
zero-knowledge proofs establish properties of hidden witnesses;
commitments bind hidden values;
Merkle trees and cryptographic accumulators commit to sets;
zero-knowledge set-membership proofs can prove membership without revealing the member;
threshold signatures can produce an ordinary externally verifiable signature only after enough key-share holders cooperate;
homomorphic encryption can evaluate supported functions on encrypted data.

The novel architectural object is their composition around the hidden-subset synthesis requirement and its recursive use as an interface.

Open engineering questions

A concrete protocol still needs choices around:

registry construction;
commitment scheme;
hidden-membership proof;
distinctness/nullifier construction;
MPC versus homomorphic evaluation;
threshold and committee model;
malicious-input handling;
output leakage controls;
proof aggregation;
recursive proof composition;
key rotation;
re-rooting semantics;
denial-of-service handling;
participant churn;
post-quantum migration;
formal composable-security analysis.

These are implementation questions.

The substrate can be recorded before they are answered.

Compression

A multi-part encrypted synthesis substrate needs to establish only a small set of facts:

the contributing pieces were eligible
the counted pieces were distinct
the required threshold was reached
the declared computation was performed
the resulting object is valid for its next interface

Everything else may remain hidden unless the application chooses to expose it.

That is enough for composition.

A participant need not reveal what it contains.

It need only prove what the next boundary requires.

And because the result can itself become a participant, the same substrate can recur:

part → whole → part → whole

This is the cryptographic spine beneath Fractal Boundary Architecture.

It is also the point at which Fractal Identity becomes implementable rather than merely descriptive.

Technical references

A. Shamir, “How to Share a Secret,” Communications of the ACM 22(11), 1979.
NIST, Privacy-Enhancing Cryptography: Multi-Party Computation and Threshold Schemes.
NIST IR 8214C, NIST First Call for Multi-Party Threshold Schemes, 2026.
RFC 9591, The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures, 2024.
ZKProof, Zero-Knowledge Proofs for Set Membership, 2020.