papers/threshold-fhe-compliance/sections/01-introduction.tex

\section{Introduction}

\label{sec:intro}
%% =====================================================================

Blockchain networks that process regulated financial instruments face a
fundamental tension between confidentiality and auditability.  Market
participants demand that their positions, orders, and balances remain
private from competitors and the public.  Regulators demand the ability
to inspect any record when exercising lawful authority.  Classical
encryption satisfies neither requirement simultaneously: encrypted data
is opaque to both the operator and the regulator, while plaintext data
is visible to both.

Fully Homomorphic Encryption resolves the computational half of this
problem.  An FHE scheme allows an untrusted operator to evaluate
arbitrary functions on ciphertexts, producing encrypted outputs that
decrypt to the correct function value.  The operator processes data
without ever observing it.  However, standard FHE concentrates
decryption power in a single key holder, creating a single point of
trust that is unacceptable for both privacy (the key holder sees
everything) and compliance (if the key holder is adversarial, the
regulator cannot force decryption).

Threshold FHE distributes the decryption key via secret sharing.  The
key $\mathbf{s}$ is split into $n$ shares $\mathbf{s}_1, \ldots,
\mathbf{s}_n$ such that any subset of $t$ shares can reconstruct a
partial decryption, but fewer than $t$ shares reveal nothing.  By
assigning shares to a mixed committee of regulated entities and the
regulator itself, the scheme simultaneously achieves:

\begin{enumerate}[nosep]
  \item \textbf{Operator blindness.}  The compute node has zero shares
        and cannot decrypt.
  \item \textbf{Forced decryption.}  The regulator, holding $t$ shares
        (or the ability to compel $t$ share-holders), can decrypt any
        ciphertext.
  \item \textbf{Privacy.}  No single entity (including the regulator,
        if it holds fewer than $t$ shares alone) can unilaterally decrypt.
\end{enumerate}

This paper formalizes the construction, proves its security properties,
and demonstrates seven concrete applications deployed on the Lux
F-Chain.

%% =====================================================================