Built on open,
verifiable cryptography.
Every primitive is public and standardised. The implementation runs entirely on your device, on open-source libraries.
- Payload cipher
- AES-256-GCM · 96-bit IV · 128-bit tag
- Key encapsulation
- Boneh–Franklin IBE + Fujisaki–Okamoto
- Pairing curve
- BLS12-381 · ~128-bit security
- Hash-to-curve
- RFC 9380 · SSWU · XMD:SHA-256
- Beacon
- drand quicknet · threshold BLS
- Scheme
- bls-unchained-g1-rfc9380
- Round period
- 3 seconds
- Integrity
- Label & signer bound as AEAD data
- Transport
- URL fragment · never sent to a server
- Storage
- None · no accounts · no database
—League of Entropy · quicknet2023-08-23 15:09:27 UTC52db9ba7…0c84e971Questions
Can the author read the capsule before the date?
No. Once sealed, the AES key exists only as an IBE ciphertext for a future round. The author holds nothing that decrypts it.
Can LOCKRA, or whoever hosts it, read it?
No. Encryption happens on your device and the capsule travels in the URL fragment, which browsers never send to the server. There is no backend.
Can someone alter the message or the label?
No. The payload is authenticated with GCM, and the label and signer are bound as additional data. Any change makes decryption fail and is reported as tampering.
What would it take to open it early?
Either breaking the BLS12-381 pairing assumptions, or a threshold of independent League of Entropy operators colluding to sign a future round. Neither is a realistic attack today.
What if drand goes offline?
The capsule opens with the signature of its round whenever it becomes retrievable from any relay. A permanent shutdown of drand would leave it sealed, so don't store anything vital only here.
Does it prove when the message was written?
It proves when it can be opened. To prove when it was written, publish the link: the timestamp of a public post is independent evidence.