Key security

Remote attestation

Also called: Attestation

A document, signed by the hardware vendor, in which an enclave proves to anyone which exact code it's running and which public keys it holds.

Remote attestation answers the question "what is actually running in there?" The enclave asks the hardware to produce a signed document containing a measurement of its code, any data the enclave adds (such as its public keys), and a nonce from whoever asked. The signature chains up to the hardware vendor's published root certificate.

To check it:

  1. Send a fresh random nonce, so the answer can't be a recording.
  2. Check the vendor's signature and certificate chain.
  3. Compare the code measurement with a published, reproducibly built release.
  4. Check the public keys are the ones you expect.

On Valtu

Anyone can call GET /v1/attestation?nonce=…, with no API key. Each enclave host returns a document with the image measurement, your nonce and the public keys the enclave holds. Production runs two hosts, and every document must pass. The wallet kit and the Python SDK include verifyAttestation / verify_attestation, and the walkthrough is in verify the code that holds your keys.

Related terms

Keep reading.

Enclave measurementA cryptographic hash of the code loaded into an enclave, reported in its attestation, so a single changed byte gives a different value. Reproducible buildA build process that turns the same source into byte-for-byte identical output every time, so anyone can confirm a binary came from the published code. Hardware enclaveAn isolated compute environment, enforced by hardware, that even the machine's own operators can't read or log in to, and that can prove which code it runs. Key ceremonyA scripted, witnessed procedure for creating master keys on offline hardware, so no single person or connected machine ever has the full secret.

More in key security: HSM · Shamir secret sharing · MPC wallet · Multisig · Approval policy · Passkey. The whole glossary.

Start free on testnetsRead the integration guide

Put it into practice.

Every workspace starts on testnets with free test coins: same dashboard, same API. Go live when your team is ready.

Get started Talk to sales