Shared parameters without sharing them
Two parties that agree on an index arrive at the same prime independently. No transfer, no storage, no drift between environments.
How · generate
Proprietary engine · up to 1,000 digits
The same certified prime, every time, from any platform
KronoSeal turns an index into a certified prime of up to 1,000 digits, reproducibly: the same index returns the same prime on any machine, with a request id and the exact server time as evidence. Validate candidates from a browser, a phone or a device with no big-number library.
- Same
- index → same prime, always
- Evidence
- request id + server time
- ≤ 1,000
- Digits per request
- Any client
- Web · mobile · IoT · cards
Where KronoSeal fits
Reproducible primes and certified results, as a service
Random generators give you a different prime every time. KronoSeal gives you the same certified prime for the same index, on any machine, with evidence attached. That is the product; speed is competitive but not the reason to buy.
Audit and compliance
Prove that a declared prime really is one. Every response carries a request id and the exact server time, usable as evidence.
How · validate · batch over WebSocket
Light clients
Browsers, mobile apps, IoT devices and smart cards cannot run large-number arithmetic comfortably. One HTTP call replaces a library.
How · generate · validate
Reproducible tests and fixtures
Same index, same prime in CI, on a laptop and in production. Cryptography teams stop hard-coding primes in test suites.
How · generate
| Need | Common approach | With KronoSeal |
|---|---|---|
| Two systems must use the same non-secret prime parameter | Generate once, then transmit it or keep it in a shared store. Environments drift when a copy is updated and another is not. | Both systems derive it from the same agreed index. Nothing to store or sync; a drift is impossible by construction. |
| Prove to an auditor that a declared prime is genuine | Re-run heavy tests after the fact, on infrastructure the auditor does not control, with no timestamped record. | One validate call returns the verdict with a request id and the exact server time. Keep the response as the record. |
| Certify or derive primes on a device with no big-number library | Port and maintain a cryptographic library on each platform, or skip the check. | One JSON request from any platform. The device receives a clean string and a verdict. |
Be precise with your threat model: the index travels to the API, so a secret index must only be used with the on-premise deployment. Responses are not yet cryptographically signed; the request id and server time are a record, not a signature.
Read this before you build on it
A predictable index gives a predictable prime.
Never derive secret keys, RSA factors or any secret from an index someone could guess. Use a high-entropy secret index, or a random generator for that job.
Not a replacement for your local library when you only need speed.
At small sizes your own library is faster and pays no network round trip (≈ 230 ms). KronoSeal earns its place through reproducibility, evidence and platform independence.
Size and instance matter.
Up to 500 digits: milliseconds on a dedicated instance. 1,000 digits: 1-1.5 s on a dedicated instance and not reliable on the public demo. Workloads above 600 digits need a dedicated plan.
Interactive simulator
Run the engine on a 1,000-digit string
Paste a decimal index or candidate of up to 1,000 digits, or load a preset. Values travel as JSON strings, never as numbers, so nothing is truncated in transit.
DEMOThis public simulator runs on a deliberately small demo instance with a tight quota (30 requests per 10 minutes, up to 300 digits). Paid plans run on dedicated instances up to 30× faster; see the live figures below.
0 / 1000 digits
The simulator uses a short-lived demo token unless you paste a key here. Keys stay in this browser only. Demo: 30 requests per 10 minutes, up to 300 digits or 1024 bits.
kronoseal-core — session
Awaiting input. Load a preset and press Run.
Engine time per run
Logarithmic scale · microseconds · measured by Go on the server
Run the engine to plot timings.
Quickstart
Call it from your stack in one minute
Digits always travel as JSON strings, never as numbers. Run the generate example twice: you get the same prime both times. Every response carries an Ed25519 signature you can verify offline with the public key. Anonymous calls are limited to 5 per second; add an X-API-Key header on a paid plan.
# generate: run it twice, the prime is identical
curl -s -X POST https://api.kronoseal.com/api/v1/kronoseal/generate \
-H 'Content-Type: application/json' -H 'X-API-Key: ks_test_…' \
-d '{"n_target":"3141592653589793238"}'
# validate a candidate
curl -s -X POST https://api.kronoseal.com/api/v1/kronoseal/validate \
-H 'Content-Type: application/json' -H 'X-API-Key: ks_test_…' \
-d '{"x_candidate":"942477796076937971538793014983850865259150819812541"}'Header for paid plans: X-API-Key: ks_test_… | ks_live_… · 401 without key · 429 + Retry-After on rate or quota · 503 + Retry-After when the engine is saturated
Performance · independent benchmark
Measured against the methods the industry runs in production
All rows measured by us on one Apple M1 core, Go 1.25, OpenSSL 3.6, same random inputs, single request. p50 of 30 runs at 19 digits down to 5 runs at 1,000 digits. OpenSSL rows are CLI timings and include ~15 ms of process start-up. No vendor-supplied figures were used. Engine build of 2026-09-11.
| Method | 19 digits | 100 digits | 300 digits | 500 digits | 1,000 digits |
|---|---|---|---|---|---|
| KronoSeal engine deterministic: same index, same prime | 0.24 ms | 2.4 ms | 35 ms | 118 ms | 2.0 s |
| Go crypto/rand.Prime TLS key generation in Go | 0.12 ms | 2.9 ms | 43 ms | 132 ms | 2.5 s |
| Next-prime search GMP / OpenSSL style | 0.10 ms | 3.2 ms | 51 ms | 190 ms | 4.0 s |
| OpenSSL prime -generate CLI, includes start-up | 17 ms | 17 ms | 29 ms | 330 ms | 2.5 s |
| Method | 19 digits | 100 digits | 300 digits | 500 digits | 1,000 digits |
|---|---|---|---|---|---|
| KronoSeal engine certified result | 0.17 ms | 1.7 ms | 11 ms | 38 ms | 280 ms |
| Industry default Go / GMP baseline | 0.17 ms | 1.7 ms | 10 ms | 38 ms | 279 ms |
| OpenSSL prime CLI, includes start-up | — | — | — | — | 1.15 s |
| Instance | 19 digits | 100 digits | 300 digits | 500 digits | 1,000 digits |
|---|---|---|---|---|---|
| Demo instance (public simulator) 1/16 vCPU · what you get on this page | 0.8 ms | 7.7 ms | 547 ms | 6.0 s | ≈ 30 s · may time out |
| Standard, 1 vCPU Sandbox plan target | 0.4 ms | 3.4 ms | 21 ms | 224 ms | 1.5 s |
| Standard, 4 vCPU · parallel Enterprise plan target | 0.5 ms | 3.8 ms | 20 ms | 190 ms | 1.0 s |
Measured against api.kronoseal.com from Mexico on 2026-09-11 with the current engine build, random indices, engine time reported by the server (p50). Network round trip adds ≈ 230 ms. Instance sizes are Cloudflare Containers tiers.
How to read this
- ·Generation: from 100 digits up, KronoSeal is on par with or faster than Go's production generator (2.4 vs 2.9 ms at 100 digits, 2.0 vs 2.5 s at 1,000) and 1.3× to 2× faster than a standard next-prime search. At 19 digits fixed overhead dominates and Go is 2× faster. On top of that, KronoSeal is deterministic: the same index always returns the same certified prime, which random generators cannot offer.
- ·Validation: same cost as the industry default, same certification strength.
- ·Every response carries the exact server time so you can reproduce these numbers against the live API.
Pricing
A plan for every exposure level
USD
Get a free Sandbox key
10,000 requests per month, 5 per second, up to 300 digits, shared instance. One key per email; shown once.
Online checkout is not open yet. Write to sales@kronoseal.com and we will provision your plan by hand.
Coming soon
Plans open soon
We are finalizing pricing. Leave your email and we will notify you when subscriptions open.
Notify me