Time-Lapse Cryptography has been introduced by Michael Rabin and Christopher Thorpe in the paper “Time-Lapse Cryptography”, but it does not seems to be popular. It is a really good paper with an great theoretic background and the authors themselves mention to release an implementation of it “in a few months” (stated in 2006). Yet surprisingly, I couldn't find any reference of it on Google.

Does any one know the reason behind this? Have the authors abandoned this idea?

  • 1
    $\begingroup$ I was at IEEE S&P in 2009 and Chris presented it as a poster there. Also, I'm assuming this is one of the authors: crypto.stackexchange.com/users/2389/christopher-thorpe So they were at least still pushing it in 2009. I really liked the paper too. $\endgroup$
    – mikeazo
    Dec 26, 2013 at 2:31

2 Answers 2


I suspect the main (only?) reason is that nobody's set up the necessary distributed key generation infrastructure. That's not as easy to do as you might think, since, for the scheme to be practical and credible, the key generation network needs to meet a bunch of challenging requirements:

  • It needs to be composed of multiple unrelated parties located in separate regions, so that no plausible adversary can compromise a majority of the network (or more than the threshold number of nodes, if lower). It would also be desirable for most of the parties to be considered generally trustworthy to begin with, but the whole point of the distributed key generation network is to avoid relying on this.

  • The hardware and software used by the nodes should be as secure and well reviewed as possible, to avoid it being compromised. Yet, on the other hand, it would be desirable for the nodes to use many independent implementations of the protocol, so that a vulnerability in any single implementation cannot be used to compromise a majority of the network. These requirements are, alas, even more difficult to realize together than they are separately.

  • The parties need to be committed to maintaining their nodes: if too many of the nodes participating in the original public key generation cease operating, the private key can never be reconstructed. It's possible to mitigate this issue somewhat if new nodes enter the network, both by having existing nodes generate new shares for new nodes and by having closing nodes pass on their shares to others. However, both of these mechanisms also increase the risk of early compromise, so they need to be considered carefully.

The first and second requirements are challenging enough, but not impossible to meet: both the Tor and Bitcoin networks demonstrate that. However, I suspect that it's the last one that's the killer: all successful distributed crypto networks that I know of contain a large number of ephemeral nodes. For time-lapse cryptography, most of the nodes need to stick around for however long you want the secrets to be kept.

Another, related problem with Rabin and Thorpe's proposal is that it doesn't really offer any obvious incentive for anyone to commit to maintaining a node. Contrast that with e.g. Bitcoin, which provides direct financial incentives for keeping the network running, and Tor, which strongly encourages anyone using the network to also participate in it as a relay.

Both of these networks also deliberately keep the barrier of entry very low, something which I wouldn't see as practical with time-lapse cryptography for the reasons described above: if somebody's going to join the network, you want to be reasonably sure that they're going to stick around, and that they're not just the next one in a string of a million sockpuppets created by an attacker.


Not sure why the idea didn't took off. Maybe because the idea from the original time lock puzzle by rivest that achieves a similar goal of sending messages to the future was more popular?

Time lock puzzles allow the receiver to self decode the encrypted message after a predetermined amount of time which could be considered a nice property which time lapse cryptography didn't have.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.