PQCMay 2, 2026 · 11 min read

The Electret Ledger: Davson's Storehouse Principle for Append-Only Cryptographic Logs

Cyril W. Davson, expounding the most mechanically peculiar component of Schappeller's apparatus — the electret — wrote that its function was to hold the medium under stress, indefinitely, until released by an external trigger. Append-only cryptographic logs do something structurally identical with a different substance. The same design instinct is what makes the seven-layer Fibonacci-weighted CVKDF cascade that sits at the heart of VRIL-KEM the right primitive to build the next generation of those logs around.

Append-only logs are an old and well-understood class of data structure. The Merkle tree is older than the World Wide Web. Certificate Transparency, the most operationally important deployment of an append-only log in the wild, has been running since 2013. The cryptographic primitives are well-studied, the threat models are well-articulated, and the tooling is mature. There is, against this background, no obvious reason to design a new one.

The argument for doing so anyway turns on a question the existing literature does not pose cleanly: what is the analogue, in an append-only log, of a substance that holds energy under stress until it is summoned?

The Electret in Davson's Reading

One of Karl Schappeller's most distinctive design choices was an internal core component he called the sublimate or electret: a substance, prepared by a six-week transpiration process, that occupied the rotor coil of his dynamic stationary sphere and was understood to store the medium's energy indefinitely without leakage. Davson, formalising the concept, wrote:

The function of the electret is to bind the medium in a state of standing tension. The substance does not generate energy and does not consume it. It stands as a witness to the configuration of the medium at the moment of its preparation, and that witness can be summoned at any later moment by the appropriate excitation.Davson, c. 1955, on the electret

Strip the metaphysical vocabulary and what remains is a definition of an extraordinarily useful primitive: a witness to a configuration, summonable at any later moment by the appropriate excitation, with no leakage between preparation and summons. That is the definition of an append-only cryptographic log entry, more precisely than most cryptographic textbooks state it.

A luminous cutaway hemisphere on the left with woven graphite mesh outer shell containing a glowing violet crystalline cylindrical core, with delicate light filaments streaming rightward from the core and weaving into a downward-cascading binary tree structure of small glowing teal-and-violet crystalline cubes on the right — Fig. 1 — The metamorphosis we are taking literally. The electret-as-witness on the left becomes the root-as-witness on the right; the crystalline structure persists.

Where the Existing Logs Fall Short

Consider the canonical Merkle-tree append-only log. Each entry is hashed; pairs of hashes are combined into parent hashes; the root hash is published. To prove an entry is in the log, you provide the entry, the leaf hash, and the chain of sibling hashes up to a published root. The proof is short and verifies quickly. Crosby and Wallach formalised the data structures at USENIX Security 2009.

The post-quantum problem is well-known: the hash function survives a quantum adversary (no efficient quantum attack on SHA-256 or SHA-3 reduces preimage resistance below 2¹²⁸), but the signature over the published root does not. Most production logs sign their root with ECDSA, which Shor's algorithm dismantles in polynomial time on a sufficiently large quantum computer.

The standard fix is to swap the signature for a post-quantum scheme — SLH-DSA (the NIST-standardized form of SPHINCS+, finalized in FIPS 205 on 13 August 2024) is the chosen primitive. The fix works. It is also unsatisfying, because it treats the log as a thing to which a signature is attached. The Davson reading frames the problem differently: the log is the witness, and the signature should be a property of the log's structure, not an external attachment.

Symbolic two-key cipher diagram: a single ornate violet keyhole at the centre approached by two distinct keys — a classical brass key glowing copper from the left labelled X25519 ECDH, and a futuristic crystalline lattice key glowing teal from the right labelled ML-KEM-1024 — with a faint chain linking the two keys — Fig. 2 — The hybrid KEM. Both keys must turn simultaneously; an adversary who breaks either primitive in isolation gains nothing.

What an Electret-Style Log Would Look Like

An append-only log whose structure is intrinsically signed has three departures from the standard Merkle tree:

Hash-based signatures inline at every level. Instead of signing only the root with SLH-DSA, every internal node carries a SLH-DSA signature over its two children. The signatures are verifiable independently. The storage cost rises sharply — a stateless hash-based signature at every internal node of a Merkle tree is by far the dominant byte cost in the structure — and the design question is whether the operational benefit is worth the cost. The benefit is that any subtree of the log is independently verifiable without trusting any external signing authority, which collapses incident-response trust-chain reconstruction from days to seconds. For a regulator, an auditor, or a compliance team, the asymmetry between storage cost and reconstruction cost runs in the right direction.
The “summons” operation is a one-message protocol. To summon entry N from the log, the caller sends N. The log returns the entry, the inclusion proof, and the chain of inline signatures up to the most recent root. The caller verifies the proof with public hash-based verification keys and accepts the entry. The protocol is one round-trip and uses no online signing.
The witness has no leakage. The log entries are encrypted at rest with a hybrid KEM (X25519 + a lattice-based KEM) such that decryption requires both classical and post-quantum secret material. An adversary who exfiltrates the log storage gains the ciphertexts and the inline-signature chain — which is enough to verify that entries existed at certain times, but not enough to read them. The structural property and the confidentiality property are decoupled.

A binary Merkle-tree structure with 16 leaves at the bottom and a root at the top suspended in deep void, with every node carrying a glowing violet hexagonal SLH-DSA signature seal beside it, glowing more brightly closer to the root, with copper hash edges connecting the nodes — Fig. 3 — SLH-DSA signatures attached to *every* internal node, not only the root. The storage cost is what buys independent subtree verification.

Why VRIL-KEM Is the Right KEM Half

The lattice half of the hybrid KEM does not have to be the smallest possible parameter set; for an append-only log whose entries are written once and read for decades, the right place on the cost/security curve is the one with the largest quantum margin the storage budget will tolerate. VRIL-KEM, the company's flagship MLWE-based construction (n=4096, q=12289, k=7, targeting 384-bit quantum security at NIST Level 5+), is built around a seven-layer Fibonacci-weighted CVKDF cascade with each layer derivable independently from a domain-separated transcript — a structure that maps almost too neatly onto the inline-signature design. The cascade is the same one that anchors the entropy-pipeline staging in VRIL-ZIP; using it for the encryption half of an append-only log lets the same key-derivation discipline govern both the contents at rest and the inclusion-proof verification path. The IND-CCA2 reduction is mechanised in EasyCrypt; the AVX2-optimised reference implementation reaches 2.4 ms keygen on a single core, which is well below the cost of any of the hash-based signature operations on the same node. The KEM is the cheap half; the signatures are the expensive half; the design budget is the right way around.

Why the Analogy Earns Its Keep

The Davson framing supplies two design choices the standard frame would not arrive at:

The first: signatures everywhere, not just at the root. The default impulse of a cryptographer is to minimize signature operations because they are computationally expensive. The Davson impulse is the opposite: every point in the structure should be its own witness, so that the witness can be summoned at any granularity. The storage cost is the cost of taking the impulse seriously; the operational benefit is that incident response that previously required days of trust-chain reconstruction collapses to seconds, because any subtree is independently verifiable.

The second: structural confidentiality, not bolted-on encryption. Most append-only logs treat encryption as a separate layer. The electret model insists that the log entry's existence and the log entry's contents are two summonable properties of the same witness, and they should be summoned by different excitations (different keys). The hybrid-KEM scheme makes this clean: a regulator can be given the ability to verify existence-and-time without the ability to read contents, and the cryptographic separation is enforced by the structure of the log rather than by access control on the storage tier.

The Davson Lineage

The Davson reading of the electret — an artefact that binds a configuration and holds it without leakage until summoned — is the cleanest specification we have found for the data structure modern post-quantum cryptography wants, and taking the specification seriously produces a different design than the standard literature would arrive at. The result is a log whose design is post-quantum-safe by construction, not by retrofit; whose structure is independently verifiable at any level; and whose confidentiality and integrity properties are cleanly decoupled.

The cryptographic constructions are conventional and reviewed against the FIPS 205 and FIPS 203 specifications. The 1928 Wetzel-Gföllner monograph and the 1955 Davson exposition are both in the public domain, and the design instinct they supplied is what we credit by name. The published cryptographic work the team anchors this on continues in the open at github.com/VRIL-LABS.