Home/Overview

Overview

Understanding TEE-based encrypted key-value storage

1What is Key-Manager?

Key-Manager is a TEE-based encryption service that provides hardware-backed key derivation and encrypted key-value storage. It runs inside OutLayer's secure enclave with CKD (Confidential Key Derivation) — meaning nobody knows the encryption keys, not even you.

It combines the security of Trusted Execution Environments (TEE) with client-side encryption to protect your data both in transit and at rest, while maintaining verifiable attestation of all operations.

2Why Does It Exist?

The Problem

• Keys stored on servers can be stolen
• Server operators can access your data
• No proof that encryption actually happened
• Network requests expose plaintext
• Difficult to manage key rotation

The Solution

• Keys derived in hardware-protected TEE
• Operators never see plaintext or keys
• Attestation proves TEE execution
• Client-side encryption protects in transit
• Deterministic key derivation (CKD)

3Architecture

┌─────────────────────────────────────────────────────┐
│                Your Application                      │
│           (TypeScript/JavaScript)                   │
└──────────────────┬──────────────────────────────────┘
                   │
                   ├─ Request wrapped key
                   │
┌──────────────────▼──────────────────────────────────┐
│         OutLayer TEE (Secure Enclave)               │
│  ┌───────────────────────────────────────────────┐  │
│  │  WASM Contract (key-manager)                  │  │
│  │                                               │  │
│  │  1. CKD Key Derivation                        │  │
│  │     Hardware Seed → AES-256 Key               │  │
│  │                                               │  │
│  │  2. Key Wrapping                              │  │
│  │     Wrap with user's public key               │  │
│  │                                               │  │
│  │  3. Attestation Generation                    │  │
│  │     Proof of TEE execution                    │  │
│  └───────────────────────────────────────────────┘  │
│                                                      │
│  Hardware-Isolated Memory (Secure)                  │
└──────────────────┬──────────────────────────────────┘
                   │
                   │ Return wrapped key + attestation
                   │
┌──────────────────▼──────────────────────────────────┐
│              Client Browser                          │
│  ┌───────────────────────────────────────────────┐  │
│  │  1. Unwrap Key (with user private key)        │  │
│  │  2. Generate Random IV (12 bytes)             │  │
│  │  3. AES-256-GCM Encrypt Plaintext             │  │
│  │  4. Serialize: enc:AES256:keyId:base64(...)   │  │
│  └───────────────────────────────────────────────┘  │
└──────────────────┬──────────────────────────────────┘
                   │
                   │ Store ciphertext only
                   │
┌──────────────────▼──────────────────────────────────┐
│        Storage (FastKV / Blockchain)                │
│                                                      │
│  enc:AES256:01560100ddd39635:hM60OnrQ6W2y...        │
│                                                      │
│  ✅ Ciphertext only (no plaintext, no keys)         │
└──────────────────────────────────────────────────────┘

4Key Components

TEE Contract

WASM binary running inside OutLayer's secure enclave

RustWASMTEE

contract/src/lib.rs

Client Library

TypeScript/JavaScript client for encryption and key management

TypeScriptWeb Crypto APIAES-GCM

client/src/PrivateKV.ts

FastKV Adapter

Storage backend for encrypted key-value data

FastKVNEARBlockchain

client/src/FastKVAdapter.ts

OutLayer TEE Adapter

Communication layer with OutLayer's TEE infrastructure

TEEAttestationCKD

client/src/OutLayerAdapter.ts

5Quick Start

1. Deploy Contract

# Download pre-compiled WASM (v0.3.1)
wget https://github.com/Kampouse/key-manager/releases/download/v0.3.1/key-manager.wasm

# Deploy to OutLayer
outlayer deploy --name your-project key-manager.wasm

2. Install Client

npm install near-fastkv-encrypted

# or
yarn add near-fastkv-encrypted

3. Use in Your App

import { PrivateKV, FastKVAdapter, OutLayerAdapter } from 'near-fastkv-encrypted';

const kv = new PrivateKV({
  accountId: 'your-account.near',
  storage: new FastKVAdapter({
    apiUrl: 'https://your-fastkv-server.com',
    accountId: 'your-account.near',
  }),
  tee: new OutLayerAdapter({
    network: 'mainnet',
    signTransaction: async (tx) => {
      // Your signing logic
    },
  }),
});

// Encrypt and store
await kv.set('my-secret', 'hello world');

// Retrieve and decrypt
const plaintext = await kv.get('my-secret');

Back to Home Security Model