Peal compared
Commit-reveal, a trusted server, timelock encryption, drand tlock, trusted enclaves and threshold decryption: what each one trusts, what it costs, and when Peal is the right choice.
The short answer
Every approach below keeps a submission unreadable until some moment. They differ on three questions: who could open it early, whether a participant can refuse to reveal, and what decides the moment.
| approach | who could open it early | can someone refuse to reveal? | what opens it |
|---|---|---|---|
| Commit-reveal | nobody: only a hash is posted | yes: each participant must come back and reveal, and the one who is losing can decline | each participant, one by one |
| A trusted server or escrow | the operator, who holds the key | the operator can refuse or delay | the operator |
| Timelock puzzle or VDF | nobody, until someone finishes the sequential computation | no | compute, not a clock; faster hardware moves the deadline |
| drand tlock | nobody, until the beacon publishes that round | no | the beacon’s round schedule; no block-height deadline |
| Keys in a trusted enclave (TEE) | whoever breaks the enclave, silently | the enclave’s operator can withhold | the enclave, at the deadline |
| Threshold decryption per message | a threshold of the committee | no | the committee, one message at a time |
| Peal | a threshold of the committee: any 3 of 5 operators acting together | no: opening is the network’s job, not a participant’s | a time or a block height, for a whole batch at once |
What Peal adds on top of encryption
- One opening for the whole batch. A round’s seals open together in one threshold decryption per 64-slot batch, so a round of sixty costs what a round of one costs, and nobody reads their result before anyone else.
- Nothing leaks while it is open. Payloads are padded to a fixed width, and how many have been sealed is withheld until the round opens; afterwards each batch is padded with decoys, so the slot count is not the participant count.
- Checkable afterwards. A seal’s id is the SHA-256 of its ciphertext, and its proof shows the batch order was committed before the reveal, with positions derived from the ciphertext hashes rather than arrival order.
- Built to be called. Plain HTTP with no key, account or wallet; a one-file client that encrypts in the browser or Node; a skill for coding agents; optional pay-per-call over x402.
What Peal trusts, today
Peal’s guarantee is a threshold one: fewer than three of the five operators learn nothing. The key shares are distributed among the five operators, which Peal runs during testnet, and in v1 the shares come from a distributed key generation (see the roadmap). An independent audit comes before mainnet. How it works says exactly what a seal’s proof proves.
When to choose which
- Choose Peal when losing participants must not be able to withhold, when the deadline is a time or a block height you set, when many submissions should open at once without revealing how many there were, or when agents and ordinary users must take part without a wallet.
- Choose commit-reveal when every participant is reliably online to reveal, a reveal is cheap, and a missing reveal can simply be penalised; it needs no committee at all.
- Choose drand tlock for a single message that should open on a public schedule, with a decentralized beacon you can rely on and no need to batch or hide counts.
- Choose a timelock puzzle when no committee or network can be relied on at all, and a loose deadline measured in computation is acceptable.
- Choose a trusted enclave when you already depend on that hardware vendor and want something running quickly.
Where to go next
- Quickstart: seal something and watch it open, from this page.
- The protocol: the cryptography, the committee and the engine.
- Glossary: every term on this page, defined.