TLOSMultiWitness.sol - N-of-M threshold witness encryption

[igor53627]

Parent Issue

Closes part of #47

Description

Build a threshold witness encryption contract where a secret is revealed when N out of M authorized witnesses provide their codes.

Use Case

Traditional threshold schemes use Shamir secret sharing or multisig. TLOS enables:

• M code holders registered at deployment
• Secret released when any N provide valid codes
• Codes are independent (not Shamir shares)
• Each code protected by 2^76 puzzle

Example Flow

Witnesses (M=5)                  Contract                          Anyone
   |                                |                                  |
   | deploy(codeHashes[5], N=3)     |                                  |
   |------------------------------->| threshold = 3                    |
   |                                |                                  |
   | provideCode(code1, puzzle)     |                                  |
   |------------------------------->| count = 1                        |
   |                                |                                  |
   | provideCode(code2, puzzle)     |                                  |
   |------------------------------->| count = 2                        |
   |                                |                                  |
   | provideCode(code3, puzzle)     |                                  |
   |------------------------------->| count = 3 >= N                   |
   |                                |                                  |
   |                                |--- SECRET REVEALED ------------->|

Key Features

• M code hashes stored at deployment
• Configurable threshold N (1 <= N <= M)
• Each code can only be used once
• Order-independent (any N codes work)
• Optional: weighted codes (some worth more)
• Optional: time-locked threshold changes

Security Model

• What's hidden: The secret, individual codes
• What's public: M, N, which codes have been used
• Guarantee: Must brute-force N codes (N × 2^76 minimum)

Use Cases

• Corporate secret recovery (3-of-5 executives)
• Inheritance with multiple heirs required
• Distributed key custody
• Emergency access with quorum

Comparison to Shamir

Aspect	Shamir	TLOSMultiWitness
Share generation	Complex math	Independent codes
On-chain verification	Needs assembly	Puzzle-protected
Brute-force resistance	None (just hashes)	2^76 per code
Flexibility	Fixed at creation	Could add time constraints

Acceptance Criteria

• Contract compiles and passes tests
• Various N-of-M configurations tested
• Edge cases: N=1, N=M, duplicate codes
• Gas benchmark documented

[igor53627]

N-of-M Threshold Use Cases Analysis

Good Fit (TLOSMultiWitness works well)

Use Case	Description	Why TLOS Works
Corporate secret recovery	3-of-5 executives unlock emergency funds	Independent codes, no single point of failure
DAO emergency controls	N guardians can pause/unpause protocol	Quorum-based without key management
Inheritance with multiple heirs	2-of-3 family members unlock estate	Each heir has own code, not Shamir shares
Distributed key custody	Multiple custodians for treasury	No trusted dealer needed
Research data release	N-of-M researchers approve publication	Prevents single researcher from leaking
Whistleblower dead drops	Multiple journalists must verify before release	Protects source until quorum agrees
Game guild treasuries	Officers must agree on large withdrawals	Social coordination + crypto enforcement
Multi-party computation triggers	Start MPC ceremony when N parties ready	On-chain coordination signal

Not Good Fit

Use Case	Problem
High-frequency operations	N x 1.3M gas per activation too expensive
Large N (>7 on L1)	Gas exceeds practical limits
Anonymous witnesses	Need to track which codes used; some identity leakage
Real-time voting	Too slow/expensive for live governance

Comparison to Alternatives

Aspect	Safe Multisig	Shamir Secret Sharing	TLOSMultiWitness
Setup	Key generation	Trusted dealer splits secret	Independent code generation
Witness identity	Public addresses	Off-chain	Code holders (can be anonymous)
Brute-force resistance	N/A (signatures)	Hash of recombined secret only	2^76 per code
On-chain cost	~150k gas	~50k (single hash check)	N x 1.35M gas
Flexibility	Fixed signers	Fixed shares	Codes are independent

Target Market

Organizations needing threshold control with:

• Low-entropy memorable codes (not just private keys)
• Independence between witnesses (no Shamir dealer trust)
• Brute-force protection for each witness slot

Gas & Feasibility

• Gas cost: N x 1.35M (e.g., 3-of-5 = ~4M gas)
• Recommended cap: N ≤ 5-7 on L1; higher on L2
• Complexity: M (1-3 days) - builds on TLOSDeadManSwitch patterns