[ethresear.ch] [Cryptography] Towards Encrypted Mempools from Threshold IBE without Batching

Hi @GottfriedHerold, thanks for this post.
I built on it in a recent write-up and wanted to share the connection, since it touches the refusal path.

In the design as written, refusing to release a share is free, so a coalition of n−t+1 members could combine the honest shares with its own, see the plaintexts, and then refuse. I call this the coalition’s free option, and in my post I try to price it and remove it with a layer I call Blind Simultaneous Release (BSR):

• Once B[n+1] is fast-confirmed, each member posts an escrow within a short window ω: a signed commitment to its share for blockhash(B[n]), plus the share masked by a sequential hash-chain pad. The PTC attests to the escrows it saw by the deadline, as it already does for etx_seen.
• Refusing becomes not escrowing, which is decided before anyone sees a share, so it is blind.
• After the deadline, a withheld escrow is force-opened by anyone, or, if it doesn’t match its commitment, costs the member a deposit S. Informed refusal then pays only if the gain exceeds S.
• The pads are hash-based, so the release layer is post-quantum even though the TIBE itself isn’t yet.

Under ePBS the window runs from fast confirmation of B[n+1] to the start of slot n+2, roughly 8 to 9 s, so honest solvers can be at most 3 to 3.5 times (or 7 to 8 times, with a 1 s escrow window) slower than an attacker at computing the pad. The recovery fix you agreed with @aelowsson, where the recovery block carries two keys, carries over. It just means forced openings may need to cover two batches.

I’d be happy if you could take a small look and tell me whether it aligns with your researches and direction of encrypted mempools. And if it does, how can I contribute to the work and help on this?

The paper and the Lean 4 proofs are linked in the post.