MS1 of ShutterTEE: encrypt persistence

rolling-shutter/.gitignore

@@ -9,3 +9,7 @@
 /godoc.idx
 /go.work
 /go.work.sum
+
+enclave.json
+private.pem
+public.pem

rolling-shutter/go.mod

@@ -10,6 +10,7 @@ require (
 	github.com/bitwurx/jrpc2 v0.0.0-20220302204700-52c6dbbeb536
 	github.com/deckarep/golang-set/v2 v2.1.0
 	github.com/deepmap/oapi-codegen v1.9.1
+	github.com/edgelesssys/ego v1.7.0
 	github.com/ethereum/go-ethereum v1.13.11
 	github.com/ferranbt/fastssz v0.1.3
 	github.com/getkin/kin-openapi v0.87.0
@@ -39,7 +40,7 @@ require (
 	github.com/spf13/cobra v1.6.1
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.13.0
-	github.com/stretchr/testify v1.9.0
+	github.com/stretchr/testify v1.10.0
 	github.com/supranational/blst v0.3.12
 	github.com/tendermint/go-amino v0.16.0
 	github.com/tendermint/tendermint v0.37.0-rc2
@@ -49,9 +50,9 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.27.0
 	go.opentelemetry.io/otel/trace v1.27.0
 	go.opentelemetry.io/proto/otlp v1.3.1
-	golang.org/x/crypto v0.23.0
+	golang.org/x/crypto v0.32.0
 	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
-	golang.org/x/sync v0.7.0
+	golang.org/x/sync v0.10.0
 	google.golang.org/protobuf v1.34.1
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools v2.2.0+incompatible
@@ -93,6 +94,7 @@ require (
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/gballet/go-libpcsclite v0.0.0-20191108122812-4678299bea08 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.4 // indirect
 	github.com/go-kit/kit v0.12.0 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
@@ -238,9 +240,9 @@ require (
 	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/mod v0.17.0 // indirect
 	golang.org/x/net v0.25.0 // indirect
-	golang.org/x/sys v0.20.0 // indirect
-	golang.org/x/text v0.15.0 // indirect
-	golang.org/x/tools v0.21.0 // indirect
+	golang.org/x/sys v0.29.0 // indirect
+	golang.org/x/text v0.21.0 // indirect
+	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
 	gonum.org/v1/gonum v0.13.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240513163218-0867130af1f8 // indirect
 	google.golang.org/grpc v1.64.0 // indirect

rolling-shutter/go.sum

@@ -186,6 +186,8 @@ github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDD
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/edgelesssys/ego v1.7.0 h1:NzCiKZKalHbeRgG7+11xgADgOPR8laSxxazOH303QVw=
+github.com/edgelesssys/ego v1.7.0/go.mod h1:xBU369lGvxWTuMLlJv3tT6bI66hrpkCFn/292zzl7U4=
 github.com/elastic/gosigar v0.12.0/go.mod h1:iXRIGg2tLnu7LBdpqzyQfGDEidKCfWcCMS0WKyPWoMs=
 github.com/elastic/gosigar v0.14.2 h1:Dg80n8cr90OZ7x+bAax/QjoW/XqTI11RmA79ZwIm9/4=
 github.com/elastic/gosigar v0.14.2/go.mod h1:iXRIGg2tLnu7LBdpqzyQfGDEidKCfWcCMS0WKyPWoMs=
@@ -243,6 +245,8 @@ github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E=
+github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
 github.com/go-kit/kit v0.12.0 h1:e4o3o3IsBfAKQh5Qbbiqyfu97Ku7jrO/JbohvztANh4=
 github.com/go-kit/kit v0.12.0/go.mod h1:lHd+EkCZPIwYItmGDDRdhinkzX2A1sj+M9biaEaizzs=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
@@ -927,6 +931,8 @@ github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
 github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
 github.com/supranational/blst v0.3.12 h1:Vfas2U2CFHhniv2QkUm2OVa1+pGTdqtpqm9NnhUUbZ8=
@@ -1068,6 +1074,8 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf
 golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
 golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
+golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1191,6 +1199,8 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180810173357-98c5dad5d1a0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1272,6 +1282,8 @@ golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
+golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -1298,6 +1310,8 @@ golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1372,6 +1386,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.21.0 h1:qc0xYgIbsSDt9EyWz05J5wfa7LOVW0YTLOXrqdLAWIw=
 golang.org/x/tools v0.21.0/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

rolling-shutter/keyper/database/extend.go

@@ -12,6 +12,7 @@ import (
 	"github.com/shutter-network/rolling-shutter/rolling-shutter/p2pmsg"
 	"github.com/shutter-network/rolling-shutter/rolling-shutter/shdb"
 	"github.com/shutter-network/rolling-shutter/rolling-shutter/shmsg"
+	"github.com/shutter-network/rolling-shutter/rolling-shutter/tee"
 )
 
 func GetKeyperIndex(addr common.Address, keypers []string) (uint64, bool) {
@@ -31,10 +32,16 @@ func (bc *TendermintBatchConfig) KeyperIndex(addr common.Address) (uint64, bool)
 func (q *Queries) InsertDecryptionKeysMsg(ctx context.Context, msg *p2pmsg.DecryptionKeys) error {
 	for _, key := range msg.Keys {
 		identityPreimage := identitypreimage.IdentityPreimage(key.IdentityPreimage)
+
+		sealedKey, err := tee.SealSecret(key.Key)
+		if err != nil {
+			return err
+		}
+
 		tag, err := q.InsertDecryptionKey(ctx, InsertDecryptionKeyParams{
 			Eon:           int64(msg.Eon),
 			EpochID:       identityPreimage.Bytes(),
-			DecryptionKey: key.Key,
+			DecryptionKey: sealedKey,
 		})
 		if err != nil {
 			return errors.Wrapf(err, "failed to insert decryption key for identity %s", identityPreimage)
@@ -49,11 +56,16 @@ func (q *Queries) InsertDecryptionKeysMsg(ctx context.Context, msg *p2pmsg.Decry
 
 func (q *Queries) InsertDecryptionKeySharesMsg(ctx context.Context, msg *p2pmsg.DecryptionKeyShares) error {
 	for _, share := range msg.GetShares() {
-		err := q.InsertDecryptionKeyShare(ctx, InsertDecryptionKeyShareParams{
+		sealedShare, err := tee.SealSecret(share.Share)
+		if err != nil {
+			return err
+		}
+
+		err = q.InsertDecryptionKeyShare(ctx, InsertDecryptionKeyShareParams{
 			Eon:                int64(msg.Eon),
 			EpochID:            share.IdentityPreimage,
 			KeyperIndex:        int64(msg.KeyperIndex),
-			DecryptionKeyShare: share.Share,
+			DecryptionKeyShare: sealedShare,
 		})
 		if err != nil {
 			return errors.Wrapf(

rolling-shutter/keyper/smobserver/smstate.go

@@ -28,6 +28,7 @@ import (
 	"github.com/shutter-network/rolling-shutter/rolling-shutter/medley"
 	"github.com/shutter-network/rolling-shutter/rolling-shutter/shdb"
 	"github.com/shutter-network/rolling-shutter/rolling-shutter/shmsg"
+	"github.com/shutter-network/rolling-shutter/rolling-shutter/tee"
 )
 
 type Config interface {
@@ -227,7 +228,13 @@ func (st *ShuttermintState) sendPolyEvals(ctx context.Context, queries *database
 		if !ok {
 			panic("key not loaded into ShuttermintState")
 		}
-		encrypted, err := ecies.Encrypt(rand.Reader, pubkey, eval.Eval, nil, nil)
+
+		plainEval, err := tee.UnsealSecret(eval.Eval)
+		if err != nil {
+			return err
+		}
+
+		encrypted, err := ecies.Encrypt(rand.Reader, pubkey, plainEval, nil, nil)
 		if err != nil {
 			return err
 		}
@@ -391,10 +398,15 @@ func (st *ShuttermintState) startPhase1Dealing(
 	}
 
 	for _, eval := range polyEvals {
+		sealedEval, err := tee.SealSecret(shdb.EncodeBigint(eval.Eval))
+		if err != nil {
+			return err
+		}
+
 		err = queries.InsertPolyEval(ctx, database.InsertPolyEvalParams{
 			Eon:             int64(eon),
 			ReceiverAddress: shdb.EncodeAddress(dkg.keypers[eval.Receiver]),
-			Eval:            shdb.EncodeBigint(eval.Eval),
+			Eval:            sealedEval,
 		})
 		if err != nil {
 			return err

rolling-shutter/medley/encodeable/keys/ecdsa.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/shutter-network/rolling-shutter/rolling-shutter/medley/encodeable"
 	"github.com/shutter-network/rolling-shutter/rolling-shutter/medley/encodeable/hex"
+	"github.com/shutter-network/rolling-shutter/rolling-shutter/tee"
 )
 
 func GenerateECDSAKey(src io.Reader) (*ECDSAPrivate, error) {
@@ -60,7 +61,7 @@ func (k *ECDSAPrivate) Equal(b *ECDSAPrivate) bool {
 }
 
 func (k *ECDSAPrivate) UnmarshalText(b []byte) error {
-	dec, err := hex.DecodeHex(b)
+	dec, err := tee.UnsealSecretFromHex(string(b))
 	if err != nil {
 		return err
 	}
@@ -73,7 +74,8 @@ func (k *ECDSAPrivate) UnmarshalText(b []byte) error {
 }
 
 func (k *ECDSAPrivate) MarshalText() ([]byte, error) {
-	return hex.EncodeHex(k.Bytes()), nil
+	str, err := tee.SealSecretAsHex(k.Bytes())
+	return []byte(str), err
 }
 
 func (k *ECDSAPrivate) String() string {

rolling-shutter/medley/encodeable/keys/ed25519.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/shutter-network/rolling-shutter/rolling-shutter/medley/encodeable"
 	"github.com/shutter-network/rolling-shutter/rolling-shutter/medley/encodeable/hex"
+	"github.com/shutter-network/rolling-shutter/rolling-shutter/tee"
 )
 
 type nullReader struct{}
@@ -69,7 +70,7 @@ func (k *Ed25519Private) Equal(b *Ed25519Private) bool {
 }
 
 func (k *Ed25519Private) UnmarshalText(b []byte) error {
-	seed, err := hex.DecodeHex(b)
+	seed, err := tee.UnsealSecretFromHex(string(b))
 	if err != nil {
 		return err
 	}
@@ -85,7 +86,8 @@ func (k *Ed25519Private) UnmarshalText(b []byte) error {
 }
 
 func (k *Ed25519Private) MarshalText() ([]byte, error) {
-	return hex.EncodeHex(k.Key.Seed()), nil
+	str, err := tee.SealSecretAsHex(k.Key.Seed())
+	return []byte(str), err
 }
 
 func (k *Ed25519Private) String() string {

rolling-shutter/medley/encodeable/keys/libp2p.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/shutter-network/rolling-shutter/rolling-shutter/medley/encodeable"
 	"github.com/shutter-network/rolling-shutter/rolling-shutter/medley/encodeable/address"
+	"github.com/shutter-network/rolling-shutter/rolling-shutter/tee"
 )
 
 func GenerateLibp2pPrivate(src io.Reader) (*Libp2pPrivate, error) {
@@ -103,7 +104,7 @@ func (k *Libp2pPrivate) Equal(b *Libp2pPrivate) bool {
 }
 
 func (k *Libp2pPrivate) UnmarshalText(b []byte) error {
-	dec, err := crypto.ConfigDecodeKey(string(b))
+	dec, err := tee.UnsealSecretFromCustomText(string(b), crypto.ConfigDecodeKey)
 	if err != nil {
 		return errors.Wrap(errFailedUnmarshalLibp2pPrivate, err.Error())
 	}
@@ -127,8 +128,8 @@ func (k *Libp2pPrivate) MarshalText() ([]byte, error) {
 	if err != nil {
 		return []byte{}, errors.Wrap(errFailedMarshalLibp2pPrivate, err.Error())
 	}
-	enc := crypto.ConfigEncodeKey(b)
-	return []byte(enc), nil
+	str, err := tee.SealSecretAsCustomText(b, crypto.ConfigEncodeKey)
+	return []byte(str), err
 }
 
 func (k *Libp2pPrivate) String() string {

rolling-shutter/shdb/db.go

@@ -15,6 +15,7 @@ import (
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 
+	"github.com/shutter-network/rolling-shutter/rolling-shutter/tee"
 	"github.com/shutter-network/shutter/shlib/puredkg"
 	"github.com/shutter-network/shutter/shlib/shcrypto"
 )
@@ -90,13 +91,18 @@ func EncodePureDKG(p *puredkg.PureDKG) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	return buff.Bytes(), nil
+	return tee.SealSecret(buff.Bytes())
 }
 
 func DecodePureDKG(data []byte) (*puredkg.PureDKG, error) {
-	buf := bytes.NewBuffer(data)
+	unsealed, err := tee.UnsealSecret(data)
+	if err != nil {
+		return nil, err
+	}
+
+	buf := bytes.NewBuffer(unsealed)
 	p := &puredkg.PureDKG{}
-	err := gob.NewDecoder(buf).Decode(p)
+	err = gob.NewDecoder(buf).Decode(p)
 	if err != nil {
 		return nil, err
 	}
@@ -127,25 +133,36 @@ func EncodePureDKGResult(result *puredkg.Result) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	return buf.Bytes(), nil
+	return tee.SealSecret(buf.Bytes())
 }
 
 func DecodePureDKGResult(b []byte) (*puredkg.Result, error) {
+	unsealed, err := tee.UnsealSecret(b)
+	if err != nil {
+		return nil, err
+	}
+
 	res := puredkg.Result{}
-	err := gob.NewDecoder(bytes.NewBuffer(b)).Decode(&res)
+
+	err = gob.NewDecoder(bytes.NewBuffer(unsealed)).Decode(&res)
 	if err != nil {
 		return nil, err
 	}
 	return &res, nil
 }
 
-func EncodeEpochSecretKeyShare(share *shcrypto.EpochSecretKeyShare) []byte {
-	return share.Marshal()
+func EncodeEpochSecretKeyShare(share *shcrypto.EpochSecretKeyShare) ([]byte, error) {
+	return tee.SealSecret(share.Marshal())
 }
 
 func DecodeEpochSecretKeyShare(b []byte) (*shcrypto.EpochSecretKeyShare, error) {
+	unsealed, err := tee.UnsealSecret(b)
+	if err != nil {
+		return nil, err
+	}
+
 	share := new(shcrypto.EpochSecretKeyShare)
-	err := share.Unmarshal(b)
+	err = share.Unmarshal(unsealed)
 	if err != nil {
 		return nil, err
 	}