[ethresear.ch] [Cryptography] Reveal optionality in encrypted mempools: how big is the sender’s free option, and a post-quantum way to remove it

Update (Oct 28): I’ve revised the paper and edited the post above. What changed:

1. Instantiation. BSR is now instantiated on @GottfriedHerold’s ticket-first threshold IBE design. Committee members escrow their key shares once B[n+1] is fast-confirmed, the PTC attests to the escrows it saw by the deadline, and refusing becomes not escrowing, which is decided blind. In the original design, a coalition of n−t+1 members could see the plaintexts and then refuse at no cost; under BSR that costs the deposit S.
2. Timing correction. Under ePBS the builder commits to its payload hash at the slot start, so the window is about 8 to 9 s rather than a full slot. The ceilings drop from 5 (or 11) to 3 to 3.5 (or 7 to 8). Escrowing on block receipt recovers 5 (or 11), but then members can’t refuse on an unconfirmed block.
3. Ticket-first sender time-locks. If availability is fixed in an extra consensus round, time-locking the transactions themselves has a ceiling of about 2. That’s why BSR puts the time-lock on the shares.
4. Lean. The development is now at 116 audited theorems, covering the new ceilings and pad lengths.

Paper and repo are updated with the most findings and assumptions in the post above.