You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
::: info DataProtector handles encryption automatically
207
-
If you're using DataProtector, result encryption is handled automatically. This section is only needed for manual encryption when not using DataProtector.
208
-
:::
206
+
::: info DataProtector handles encryption automatically If you're using
207
+
DataProtector, result encryption is handled automatically. This section is only
208
+
needed for manual encryption when not using DataProtector. :::
209
209
210
-
Secure your outputs with end‑to‑end encryption so only you (the beneficiary) can read them. Results leave the enclave and may traverse untrusted storage and networks; encryption ensures nobody else (operators, storage providers, intermediaries) can access the content.
210
+
Secure your outputs with end‑to‑end encryption so only you (the beneficiary) can
211
+
read them. Results leave the enclave and may traverse untrusted storage and
The beneficiary key pair is the root of trust for result confidentiality. The public key will be used inside the TEE to encrypt results for the beneficiary; the private key stays with the beneficiary to decrypt them locally.
217
+
The beneficiary key pair is the root of trust for result confidentiality. The
218
+
public key will be used inside the TEE to encrypt results for the beneficiary;
219
+
the private key stays with the beneficiary to decrypt them locally.
215
220
216
221
Run from your iExec project directory:
217
222
@@ -228,11 +233,14 @@ This creates two files in `.secrets/beneficiary/`:
228
233
└─ <0x-your-wallet-address>_key.pub # PUBLIC KEY
229
234
```
230
235
231
-
Back up the private key securely. You will only need it locally to decrypt results.
236
+
Back up the private key securely. You will only need it locally to decrypt
237
+
results.
232
238
233
239
### 2) Push your public key to the SMS
234
240
235
-
The Secret Management Service securely delivers your public key, at runtime, to the enclave running your iApp. Without this, the iApp cannot encrypt outputs for you.
241
+
The Secret Management Service securely delivers your public key, at runtime, to
242
+
the enclave running your iApp. Without this, the iApp cannot encrypt outputs for
243
+
you.
236
244
237
245
Make the public key available to TEEs at runtime:
238
246
@@ -248,7 +256,9 @@ iexec result check-encryption-key --tee-framework scone
248
256
249
257
### 3) Run the iApp with encrypted results
250
258
251
-
The --encrypt-result flag instructs the platform to perform envelope encryption inside the enclave using your public key, so the archive that leaves the TEE is unreadable to others.
259
+
The --encrypt-result flag instructs the platform to perform envelope encryption
260
+
inside the enclave using your public key, so the archive that leaves the TEE is
261
+
unreadable to others.
252
262
253
263
Trigger a task and request encrypted outputs:
254
264
@@ -268,9 +278,11 @@ iexec task show <0x-task-id> --download
268
278
269
279
Inside the archive, `iexec_out/result.zip.aes` is encrypted.
270
280
271
-
Note: Results are encrypted for the task beneficiary. Ensure the beneficiary address is yours to be able to decrypt the archive.
281
+
Note: Results are encrypted for the task beneficiary. Ensure the beneficiary
282
+
address is yours to be able to decrypt the archive.
272
283
273
-
If you extract the archive and try to read the encrypted file, you'll see unreadable content:
284
+
If you extract the archive and try to read the encrypted file, you'll see
285
+
unreadable content:
274
286
275
287
```bash
276
288
mkdir /tmp/trash && \
@@ -285,11 +297,13 @@ The output will look like:
285
297
Յ]9WTL*tdzO`!e&snoL3K6L9%
286
298
```
287
299
288
-
This confirms the results are properly encrypted and unreadable without the private key.
300
+
This confirms the results are properly encrypted and unreadable without the
301
+
private key.
289
302
290
303
### 4) Decrypt results locally
291
304
292
-
Results are encrypted end‑to‑end; only your private key can decrypt them. This step restores the plaintext so you can use the output files.
305
+
Results are encrypted end‑to‑end; only your private key can decrypt them. This
306
+
step restores the plaintext so you can use the output files.
293
307
294
308
Use your private key generated in step 1:
295
309
@@ -315,5 +329,7 @@ Your results are now decrypted and ready to use.
315
329
### Notes and tips
316
330
317
331
- Keep the private key offline and backed up.
318
-
- You can rotate keys by re-running generation and push steps; old tasks remain decryptable with the old private key.
319
-
- iApp code does not need changes to enable result encryption; it is enforced by the TEE using the public key from SMS.
332
+
- You can rotate keys by re-running generation and push steps; old tasks remain
333
+
decryptable with the old private key.
334
+
- iApp code does not need changes to enable result encryption; it is enforced by
0 commit comments