seal

Security

Markdown

Releases and the log

No enclave build gets keys until it's signed by two of three release keys and has been public in the transparency log for its waiting period.

Every enclave and key guardian build passes this gate before it gets keys. A bad build is still possible, but only in public.

The gate#

  1. Built reproducibly from a commit

    Anyone who builds the same public commit gets the same fingerprint.

  2. Signed by two of three release keys

    One person with one key can't ship anything.

  3. Published in the transparency log

    The log at log.seal.zone can only be added to, so a release can't be quietly removed or edited.

  4. Countersigned by witnesses

    Two of three witnesses countersign the log, so it can't show you a different history. Their timestamps are the clock for the next step.

  5. Public for the whole waiting period

    Seal can't fake the clock to shorten it.

Your SDK checks the same gate on every connection.

Signatures · 1 of 3, 2 needed

Public in the log for

not yet

Waiting period: 5 min

Key guardianNeeds a second signature
FigureA build gets keys only when both conditions hold. The preview uses a 5-minute waiting period; the clock is the log's witnessed time, not Seal's.

Seal upgrades the replica it runs for you. Yours move when you run seal deploy upgrade.

The transparency page#

The transparency page checks the log in your browser. It shows the latest checkpoint, the rules in force, every release and the keys it checks against.

It can't prove a fingerprint came from its commit. Rebuild to check that.

Rules in force#

Every key guardian and SDK applies these rules from the log:

  • Firmware floors per chip family
  • Revoked releases
  • Revoked release keys
  • Minimum enclave key versions

Witnesses refuse a log whose rules loosen, so nobody, Seal included, can undo one.

Co-signing releases yourself#

Turn on co-signing on the Admins page. A new release then gets your tenant's keys only after your admins approve it:

Terminal
$seal release approve <fingerprint> --key-file admin.key

Repeat --key-file to meet your threshold. Until then, that release can't serve you. Turning it off is widening, so it waits out your pending window.