Short answer: a public beacon called drand publishes a signed random value on a fixed schedule. Time-lock encryption lets you encrypt to a future value, which cannot be computed until it is published. So the key to open the data does not exist until the chosen moment.
The problem with "open on a date"
If you want a secret to open on a date, the obvious design is a server that holds it and releases it on time. That works exactly as long as you trust the server, its operator, its staff, its backups and every court that could order it to speak. Time-lock encryption removes the server from the story: there is nothing holding the key early, because the key cannot yet be made.
The beacon
drand is a distributed randomness beacon operated by a group of independent organisations. At fixed intervals it publishes a new random value, signed jointly by the group. Two properties matter here:
- It is public. Everyone sees the same value at the same time.
- It is unpredictable until published. A value for a future round does not exist, and no single operator can produce it alone — a threshold of the group has to sign it.
The network Halation uses is called quicknet: it publishes a new value every 3 seconds, on a schedule known years in advance, using BLS signatures over the BLS12-381 curve. The chain it trusts is pinned by hash in the app's source.
Encrypting to a round
The scheme is called tlock. In outline: the signature the beacon will publish for a future round acts as a decryption key for anything encrypted to that round. Encryption is done with public information only, today. Decryption becomes possible the instant the beacon publishes that round's signature — to everyone, simultaneously.
| Who | Before the round | After the round |
|---|---|---|
| Album members | Can add photos, cannot open them. | Open everything. |
| The person who made it | No special key. | Same as everyone. |
| The app's makers | No key to give out. | Same as everyone. |
What you still have to trust
Honest claims name their assumptions.
- The beacon's threshold. Security rests on enough independent drand operators not colluding to sign a future round early. That is a much weaker thing to trust than one company's server, but it is not nothing.
- The cryptography. The scheme is published and peer-reviewed; the implementation is one shared code path used by both the iPhone and Android apps, so there are not two versions of the lock to disagree.
- The link. Time-lock protects the photographs before the date. It does not stop a person who holds the link from joining the album.
Sources
A lock you do not have to take on trust
Free, no account, no ads. iPhone and Android.