HSS-CoFHE

Your transaction is never in one place. It is split into fragments and handed to different servers, and each fragment on its own is indistinguishable from noise. No server ever holds your data, so no server can leak it, sell it, or be compelled to hand it over.

The computation runs over the fragments. The servers never reassemble anything.

The usual objection is speed, and it is a fair one: encrypted computation has historically run thousands of times slower than plain computation, which is why on-chain privacy today is either absent or technically present and unusable. The production path here carries no encryption noise, and noise is where that cost lived.

VeriCoop is the protocol that does this, and it is worth being precise about what it achieves, because "private and verifiable" sounds like a contradiction until you separate the two words.

The servers hold fragments and jointly produce a proof. The proof is public and anyone can check it. What it proves is that the transaction was valid — and nothing whatsoever about what the transaction said.

3,506× faster per circuit operation than the collaborative-FHE baseline it replaces.

That number came from deleting work, not from optimizing it. Classical homomorphic encryption accumulates noise with every operation and has to stop periodically to clean it up, and that cleanup is most of where the time goes. The production protocol here does not accumulate it, so there is nothing to stop and clean.

Fast enough that privacy stops being a special mode you opt into and then wait for. It runs at the speed of live transactions.

No single server can open your data. Not the largest one, not the one producing the block, not all of them minus a quorum.

It takes a configured threshold of parties, acting together, to decrypt anything. Below that threshold the fragments reveal nothing at all — not less, nothing. That part does not rest on a computational assumption, so a coalition under the threshold gets nowhere even with unlimited time and a future computer.

What does rest on assumptions is the rest of the transcript. We say which is which, in the papers, instead of describing the whole system with the stronger word.

A privacy proof that only holds in isolation is worth very little, because nothing in a blockchain ever runs in isolation.

This layer is proven secure while composed — running alongside proving, consensus, and networking at once, against an adversary that gets to watch all of them together. That is a much harder statement than "secure on its own", and it is the one that matters, because attacks live in the seams between components far more often than inside them.