Confidential execution on a public ledger

§00

Abstract

Public blockchains publish every input they process. That property is what makes them verifiable, and it is also what makes them unusable for payroll, order flow, credit, healthcare, or any model whose inputs are worth more than its outputs. The industry’s answer so far has been to hide data behind a proof or a chip. Neither lets two parties compute over data that both keep secret.

Latens takes the other route. Programs execute directly on ciphertext using fully homomorphic encryption, settle on Solana, and reveal results only through a threshold committee that never reconstructs a whole key. No participant - validator, evaluator, or protocol operator - observes a plaintext at any point in the lifecycle.

§01

The visibility problem

A Solana transaction is a broadcast. Every balance, every limit price, every vote is legible to anyone running an RPC node, and legible before it is final. The resulting extraction is not a bug in any single application; it is the direct consequence of executing on plaintext in public.

Three families of mitigation exist today, and each one gives something up:

• Trusted execution environments - fast and general, but the confidentiality guarantee terminates at a hardware vendor’s attestation key, and side-channel breaks have been routine.

• Zero-knowledge proofs - excellent at proving a statement about your own secret. Structurally unable to compute over a secret you do not hold.

• Off-chain committees - reintroduce the trusted third party the ledger was built to remove.

Fully homomorphic encryption is the only primitive that lets an untrusted party evaluate an arbitrary function over data it cannot read. Until recently it was several orders of magnitude too slow to put behind a block time. That is no longer true.

§02

Preliminaries

A homomorphic scheme is defined by the correctness of evaluation: decrypting the result of a computation over ciphertexts yields the same value as computing over plaintexts.

Latens uses TFHE, in which a ciphertext is a learning-with-errors sample: a random mask a, a body carrying the scaled message, and a small error term e drawn from a discrete Gaussian.

The error is what makes the scheme secure and what makes it awkward. Addition of ciphertexts adds their errors. Multiplication is far worse: the error grows roughly with the product of the operands’ magnitudes.

Once |e| exceeds Δ/2 the plaintext is gone. Bootstrapping - homomorphically evaluating the decryption circuit itself - resets the error to a fixed level and makes circuits of unbounded depth possible. It is the single most expensive operation in the system, which is why §04 measures it separately.

Decryption authority is never held by one party. The secret key is shared across a committee of n nodes such that any t of them can produce partial decryptions that combine, via Lagrange interpolation, into a plaintext - without any node ever holding s.

§03

Protocol

An encrypted account is an ordinary Solana account whose data field holds ciphertext plus a small header: scheme parameters, the committee epoch, and a noise-budget estimate. Ownership, rent, and ordering are unchanged - Latens adds a data path, not a chain.

The lifecycle of a confidential instruction has four steps.

1. 01

   Seal

   The client encrypts inputs under the committee public key and signs the instruction as usual. The transaction that lands on Solana carries only ciphertext.

2. 02

   Schedule

   Validators order the transaction. Ordering requires no knowledge of the contents, so the existing consensus path is untouched.

3. 03

   Evaluate

   Evaluator nodes pull the sealed instruction, apply the program’s homomorphic circuit, and post the resulting ciphertext with a succinct proof that the declared circuit - and only that circuit - was applied.

4. 04

   Reveal

   If the program declares an output as public, t committee members publish partial decryptions. If the output is private, the ciphertext is re-keyed to the owner’s public key and only they can open it.

§04

Performance

The relevant question is not whether FHE is slower than plaintext execution - it is, by roughly 15× on our devnet - but whether the absolute latency lands inside a budget users already tolerate. At 210 ms p50 for a confidential transfer, it does.

Two of the four terms are constant. Consensus is Solana’s and we inherit it; threshold decryption is a fixed round trip against the committee. Only homomorphic evaluation scales with circuit depth, and it is the term that hardware acceleration attacks directly - a 16× improvement there moves a model inference from 1.3 s to under 250 ms.

§05

Threat model

We assume a static adversary that may corrupt any number of evaluators and up to t − 1 committee members, observe the entire ledger and all network traffic, and adaptively submit transactions.

• Guaranteed - confidentiality of inputs, intermediate state and private outputs; correctness of evaluation; liveness while t honest committee members remain.

• Not guaranteed - metadata privacy. Transaction size, timing and the identity of the accounts touched remain visible, and leak.

• Out of scope - compromise of the user’s own device or key material; social engineering of the owner of a private output.

Committee epochs rotate with proactive secret sharing, so an adversary must corrupt t members inside a single epoch rather than accumulating shares over time. Under the LWE assumption the scheme is believed to resist quantum adversaries; nothing else in this document depends on that.

§06

Economics

A confidential instruction pays two fees: the ordinary Solana fee for inclusion, and an evaluation fee priced in homomorphic gas - a unit derived from circuit depth and the number of bootstraps a program declares. Declaration is static, so the cost of a call is known before it is submitted.

Evaluators stake to join the mesh and are slashed for posting a ciphertext that fails the circuit proof. Committee members are paid per epoch rather than per decryption, so no member has a marginal incentive to bias which outputs get revealed.

§07

Open problems

• Metadata - access patterns are the largest residual leak. Oblivious RAM over encrypted accounts is tractable but currently costs more than the computation it protects.

• Composability - a program that branches on an encrypted condition must evaluate both branches. Deep conditional logic remains expensive and needs new compiler work.

• Key rotation at scale - re-keying every encrypted account on committee rotation is O(state). Incremental re-keying with lazy migration is implemented but under-tested.

• Accelerators - the evaluation term is bounded by polynomial multiplication. FPGA and ASIC paths exist; neither is production-ready in the open.

§08

References

1. [1]Gentry, C. Fully Homomorphic Encryption Using Ideal Lattices. STOC 2009.
2. [2]Chillotti, I., Gama, N., Georgieva, M., Izabachène, M. TFHE: Fast Fully Homomorphic Encryption over the Torus. J. Cryptology, 2020.
3. [3]Regev, O. On Lattices, Learning with Errors, Random Linear Codes, and Cryptography. STOC 2005.
4. [4]Boneh, D., Gennaro, R., Goldfeder, S. et al. Threshold Cryptosystems from Threshold Fully Homomorphic Encryption. CRYPTO 2018.
5. [5]Yakoubov, S. A Gentle Introduction to Yao’s Garbled Circuits. 2017.