Time-Based Security: When Encryption Expires

A Digital Time Capsule

Picture a physical time capsule: a sealed metal container buried in a school's foundation in 1950, designed to be opened in 2050. No one can peek inside early because the container is welded shut and buried under concrete. The only way to access the contents is to wait until the building is renovated and the capsule is dug up.

Timelock encryption creates the digital equivalent. A file is encrypted in such a way that no one, not even the person who encrypted it, can decrypt it until a certain amount of time has passed. There is no secret key to steal, no password to guess, no backdoor to exploit. The lock is time itself.

This concept was first formalized in a 1996 paper by Ron Rivest, Adi Shamir, and David Wagner titled "Time-lock Puzzles and Timed-release Crypto." Rivest is one of the inventors of the RSA algorithm (the R in RSA). Shamir invented Shamir's Secret Sharing. These are not obscure academics; they are two of the most important figures in the history of cryptography.

How Time-Lock Puzzles Work

The core idea is surprisingly elegant. A time-lock puzzle is a mathematical problem that requires a specific number of sequential computations to solve. The key word is "sequential." Unlike most computational problems, you cannot speed up a time-lock puzzle by using more computers or more CPU cores. Each step depends on the result of the previous step, so there is no shortcut.

Think of it like a combination lock with 10 million dials, where each dial's position depends on the previous dial's position. You cannot assign 10 million people to each turn one dial simultaneously; each person must wait for the person before them to finish. The only variable is how fast a single person (or CPU core) can turn dials.

In technical terms, the Rivest-Shamir-Wagner construction uses repeated squaring modulo a large number. To encrypt a file with a 1-hour timelock, the system calculates how many sequential squaring operations a modern CPU can perform per second, then encrypts the decryption key behind a puzzle that requires exactly that many operations (times 3,600 seconds). To decrypt the file, a computer must perform every single squaring operation in sequence. There is no way to skip ahead.

Why You Cannot Cheat

Normal computation scales with hardware. If a task takes 1 hour on one computer, it might take 30 minutes on two computers, or 1 minute on 60 computers. Time-lock puzzles are specifically designed to prevent this. Each squaring operation produces a result that is the input to the next operation. You cannot start step 1,000 without finishing step 999 first. Adding more CPUs, more GPUs, or even a supercomputer does not help. The only thing that matters is the speed of a single processor core performing sequential operations.

This property is called "inherent sequentiality," and it is what makes time-lock puzzles genuinely useful rather than just a theoretical curiosity. If someone builds a faster CPU that runs 2x faster, the puzzle solves in half the time. But there is no way to get a 1000x speedup by throwing 1000 computers at it.

Real-World Use Cases

Sealed-Bid Auctions

In a traditional sealed-bid auction, each bidder submits a bid in a sealed envelope. At the deadline, all envelopes are opened simultaneously. The problem is that someone has to hold the envelopes, and that person could peek. With timelock encryption, each bidder encrypts their bid with a timelock calibrated to expire at the auction deadline. The bids are published immediately, but they are encrypted. At the deadline, anyone can begin solving the puzzle, but nobody can read the bids before then. There is no trusted third party, no envelope holder, no opportunity for corruption.

Government procurement offices, which spend billions of dollars on contracts, have a real problem with bid-rigging. A corrupt official who can peek at bids before the deadline can tip off a preferred vendor to underbid the competition. Timelock encryption eliminates this possibility entirely.

Embargoed Press Releases

Media organizations frequently receive information under embargo: a company's quarterly earnings, a scientific journal article, a government policy announcement. The information is shared with journalists early so they can prepare their stories, but they are not supposed to publish until the embargo lifts. In practice, embargoes are broken constantly because enforcement relies on trust and reputation.

With timelock encryption, the embargoed material is shared in encrypted form. Journalists can have the file on their laptops, but they physically cannot read it until the embargo time arrives and the puzzle solves. There is no trust required.

Estate Planning and Time-Delayed Messages

A parent writes a letter to their child, to be read on the child's 18th birthday. A business owner writes instructions for their successor, to be accessible 30 days after their death. A whistleblower prepares a document to be released if they do not check in within 90 days.

These scenarios require data to become available at a future time, without relying on a third party. A lawyer can lose the letter. A cloud service can go bankrupt. A dead man's switch can be hacked. A time-lock puzzle tied to a specific computation time provides a self-enforcing delay that depends only on the laws of mathematics, not on any person or service remaining available.

Preventing Coercion

If someone is coerced into decrypting a file at gunpoint, they can comply if they know the password. But if the file is timelock-encrypted and the puzzle has not been solved yet, no amount of coercion can produce the plaintext. The victim genuinely cannot decrypt the file, and the attacker can verify this by attempting it themselves.

How QNSQY Implements Timelock Encryption

QNSQY's timelock implementation (available on the Business tier) wraps the standard encryption workflow with a time-lock puzzle layer. Here is what happens when you encrypt a file with a timelock:

1. Calibration. Before your first timelock operation, you run qnsqy timelock calibrate. This benchmarks your CPU to determine how many sequential squaring operations it can perform per second. The calibration result is stored locally and used to convert human-readable durations ("8 hours," "30 days") into puzzle sizes.
2. Encryption. You encrypt the file normally (with ML-KEM + X25519 + AES-256-GCM + Argon2id), producing a random symmetric key. That symmetric key is then locked behind a time-lock puzzle calibrated to the duration you specified.
3. Storage. The encrypted file and the puzzle are stored together in a .qstl file. The file header contains the puzzle parameters so that any machine can solve it (not just the one that created it).
4. Decryption. To decrypt, the recipient runs the puzzle solver, which performs the sequential computation until the key is recovered. The actual file is then decrypted normally.

# Calibrate your CPU (one-time setup)
qnsqy timelock calibrate

# Encrypt with an 8-hour timelock
qnsqy timelock encrypt -i contract.pdf --duration 8h

# Decrypt (starts solving the puzzle, then decrypts the file)
qnsqy timelock decrypt -i contract.pdf.qstl

Encryption Also Has a Shelf Life

Beyond timelock encryption, there is a broader question: how long does regular encryption protect your data? Every encryption algorithm has an effective lifespan determined by the march of technology. Data encrypted today will eventually face computers more powerful than anything that exists now.

The Data Sensitivity Timeline

Different data needs protection for different periods of time. A credit card number only matters until it expires (3 to 5 years). A business plan only matters until it is executed (1 to 3 years). But a patient's medical records need protection for the patient's entire lifetime (80+ years). Government classified documents can require protection for 25 to 75 years. Personal communications, diaries, and family records have sensitivity periods that can extend beyond a century.

Data Type	How Long It Needs Protection	Example
Credit card numbers	3-5 years	Until the card expires and is replaced
Business strategies	1-3 years	Until the strategy is executed or abandoned
Medical records (HIPAA)	Patient's lifetime (80+ years)	A newborn's records encrypted in 2026 need protection until 2106+
Trade secrets	10-50 years	Coca-Cola's formula has been secret for over 130 years
Personal communications	Lifetime + estate (100+ years)	Private letters, journals, family photos
Government classified	25-75 years	U.S. Top Secret documents are typically declassified after 25-50 years
Legal records	7-50 years	Attorney-client privilege, court records, contracts

The Quantum Deadline

The critical question is: when will quantum computers be able to break the encryption algorithms in use today?

• RSA, ECDH, ECDSA (used by GPG, Age, TLS, SSH): Vulnerable to Shor's algorithm. Expert consensus places a cryptographically relevant quantum computer (CRQC) at 10 to 20 years out. Some estimates are more aggressive (under 10 years), some more conservative (over 25 years).
• AES-256 (symmetric encryption): Grover's algorithm provides a quadratic speedup, reducing AES-256's effective security from 256 bits to 128 bits. AES-128 remains safe against quantum because Grover's algorithm, while theoretically halving the security level, still requires 2^64 quantum operations, which is impractical.
• ML-KEM, ML-DSA (post-quantum, used by QNSQY): No known quantum attack provides a meaningful speedup. Lattice problems are believed to be hard for both classical and quantum computers.

Concrete Example

A hospital encrypts a newborn patient's medical records in 2026 using RSA-2048 (a classical algorithm). The records need to remain confidential for the patient's lifetime, roughly 80 years, until 2106. A cryptographically relevant quantum computer arrives in 2040. From 2040 onward, those records can be decrypted by anyone with access to the ciphertext. The records are exposed for 66 years.

If the same hospital encrypts those records with QNSQY's ML-KEM-768 + X25519 hybrid, the quantum computer that arrives in 2040 still cannot decrypt them. The records remain protected through 2106 and beyond.

Password Strength and Time

Even with quantum-resistant algorithms, your encryption is only as strong as your password. A weak password can be guessed by trying every possibility (brute force). The strength of a password is measured in "bits of entropy," which represents the number of possible combinations expressed as a power of 2.

• 40 bits of entropy (roughly a simple 8-character password): An attacker with modern hardware can brute-force this in hours to days, even against a strong KDF like Argon2id.
• 60 bits of entropy (roughly a 12-character random password): Would take decades to brute-force against Argon2id on current hardware.
• 80 bits of entropy (roughly a 16-character random password or a 6-word passphrase): Effectively unbreakable for the foreseeable future, even accounting for hardware improvements over decades.
• 128 bits of entropy (roughly a 20-character random password or an 10-word passphrase): Beyond any conceivable brute-force attack, classical or quantum.

The key derivation function (KDF) is what makes password brute-forcing expensive. GPG's S2K lets an attacker try hundreds of millions of guesses per second. Argon2id (used by QNSQY) requires 128 MB to 512 MB of memory per guess, which limits even a GPU cluster to a few thousand guesses per second. For long-term protection of truly sensitive data, use a strong passphrase (5+ words) or a hardware key.

Re-Encryption: Upgrading Your Protection

If you have files encrypted with older, non-quantum-resistant algorithms, you can re-encrypt them with stronger algorithms today. Think of it like upgrading the locks on your house when you learn that someone has invented a new lockpicking technique.

1. Inventory. Identify all files encrypted with classical algorithms (RSA, ECDH, AES-only). These are your .gpg files, .age files, and any other non-PQC encrypted archives.
2. Prioritize. Focus first on data with long sensitivity periods: medical records, legal documents, trade secrets, personal archives. Credit card numbers that expire next year are low priority.
3. Re-encrypt. Decrypt with the original tool, then re-encrypt with QNSQY. If the file is already a .qs file encrypted with an older QNSQY version, use the qnsqy rekey command, which changes the encryption in place without exposing plaintext to disk.
4. Verify. Decrypt the new file to confirm it works.
5. Destroy originals. Use qnsqy shred to securely delete the old encrypted files and any temporary plaintext.

Combining Timelock with Standard Encryption

Timelock encryption and standard password-based encryption serve different purposes, and QNSQY allows you to use them together. A file can be encrypted with both a password and a timelock, meaning that even if someone knows the password, they cannot decrypt the file until the puzzle solves. This provides a two-layer defense: something you know (the password) plus something you must wait for (the time delay).

Real-world scenario: Merger documents. A corporation is preparing to announce a major acquisition. The announcement is scheduled for Monday at 9 AM. The legal team prepares the press release and regulatory filings on Friday, encrypts them with a timelock set for 60 hours (expiring Monday morning), and distributes them to the PR firm and the filing agent. Even if someone at the PR firm is tempted to leak the news over the weekend, they physically cannot decrypt the documents until Monday morning. The password adds a second layer: after the timelock expires, the files still require the password, so anyone who happens to intercept the file during transit cannot read it even after the timelock period.

History of Time-Lock Puzzles

The Rivest-Shamir-Wagner paper from 1996 is the foundational work, but the concept of timed-release information has fascinated cryptographers for decades. Timothy C. May, one of the founders of the cypherpunk movement, discussed "timed-release crypto" in the early 1990s as a building block for anonymous digital markets and prediction protocols.

The practical challenge has always been calibration. A puzzle must be hard enough that even a well-funded adversary cannot solve it early, yet predictable enough that the intended recipient can solve it on schedule. The Rivest-Shamir-Wagner construction achieves this by using a mathematical operation (repeated squaring) whose inherent sequentiality has been studied extensively and is well understood. No one has found a way to parallelize modular squaring, and there are theoretical reasons to believe no such shortcut exists.

In 2019, a team at MIT solved a time-lock puzzle that Rivest had created in 1999, calibrated for approximately 35 years of computation. The team solved it in about 3.5 years using a dedicated FPGA (field-programmable gate array) running the sequential squaring operation continuously. The puzzle performed exactly as predicted: it took the expected number of sequential operations, and the FPGA simply performed each operation faster than the 1999-era CPU that Rivest used for calibration. This real-world validation confirmed that the time-lock puzzle construction works as designed.

Limitations of Timelock Encryption

Timelock encryption is powerful, but it is not magic. There are real limitations you should understand:

• CPU speed is not perfectly predictable. A puzzle calibrated for "8 hours on a 2026 CPU" might solve in 4 hours on a 2030 CPU. The puzzle does not guarantee a wall-clock minimum; it guarantees a minimum number of sequential operations. Faster CPUs solve it faster.
• It is not a substitute for regular encryption. Timelock encryption prevents early decryption, but once the puzzle is solved, the file is decrypted. If you need the file to remain encrypted indefinitely and only be accessible with a password, use standard encryption.
• Puzzle computation consumes energy. Solving a 24-hour puzzle means running a CPU core at full utilization for 24 hours. For short durations (hours), this is negligible. For long durations (months, years), the energy cost is significant.
• No way to speed it up in an emergency. If you timelock-encrypt a file for 30 days and then realize you need it in 5 days, you are out of luck. There is no override, no emergency key, no backdoor. That is the entire point, but it also means you must be deliberate about the duration you choose.

Planning for the Future

1. Encrypt with post-quantum algorithms today. Do not wait for quantum computers to arrive. The "harvest now, decrypt later" threat means data intercepted today can be broken in the future.
2. Use strong passphrases. At least 5 random words or 16+ random characters. For the most sensitive data, use hardware keys.
3. Review periodically. Cryptography evolves. Revisit your encryption strategy every 2 to 3 years. QNSQY's rekey command makes it easy to upgrade algorithms without starting from scratch.
4. Keep your software updated. Security improvements, bug fixes, and new algorithm support are released regularly.
5. Use timelock for specific scenarios. It is not a replacement for passwords or keys. It is a complementary tool for situations where you need to enforce a time delay.

Sources

1. Rivest, Shamir, Wagner: "Time-lock Puzzles and Timed-release Crypto" (1996)
2. NIST FIPS 203: ML-KEM Standard
3. NSA CNSA 2.0 FAQ: Post-Quantum Migration Timelines
4. Global Risk Institute: Quantum Threat Timeline Report 2024
5. NIST IR 8547: Transition to Post-Quantum Cryptography Standards
6. World Economic Forum: Quantum Computing Cybersecurity Risks and HNDL Retention Windows

Related Articles

• Shamir's Secret Sharing Explained
• Air-Gapped Encryption: Best Practices
• Getting Started with QNSQY CLI