Smart contracts on Internet Computer can issue encryption keys they cannot read

A new approach to onchain privacy

Blockchains are transparent by design, which is ideal for auditability but creates a real problem for applications that require confidentiality. @dfinity has been working on that tradeoff for years, and its answer is now live in production: a feature called vetKeys, short for Verifiable Encrypted Threshold Keys.

vetKeys on the Internet Computer addresses the fundamental challenge of storing secrets onchain by allowing cryptographic key derivation without exposing private keys to anyone but the user. The mechanism works at the subnet level. When a canister requests a key, no single node handles the job alone. Each node in the network independently creates its own secret share of the final vetKey, then encrypts its own share using the user's transport key. A quorum of those encrypted shares is then combined, so neither the nodes nor the canister ever holds the raw key in the clear. Users can also verify that the key came out of the protocol correctly and was not tampered with.

Crucially, the key is never stored anywhere. It is rebuilt on demand from the same inputs every time, which means a user who signs in on a new device will receive the same key back without having to remember a password or carry a seed phrase. With vetKeys, users can benefit from end-to-end encryption without having to remember decryption keys or passwords, as the key management is provided by ICP.

Live on mainnet since July 2025

With the Niobium milestone, the Internet Computer Protocol took a significant step forward in bringing new levels of privacy to the blockchain, with the vetKeys feature now live and available for all developers building on ICP. Access control is handled entirely in application logic, not at the cryptographic layer. The app decides who may request a key through its own code, and each key request costs the canister a small fee in cycles.

With vetKeys, developers can build dapps where users' data is encrypted, addressing privacy needs on a public blockchain for the first time. vetKeys are built on a new verifiably encrypted threshold key derivation protocol, called vetKD, which lets canister smart contracts manage and request cryptographic keys that are securely derived and encrypted with a user's public key.

Many real-world applications rely on confidentiality, including messaging, identity, healthcare, finance, governance, and gaming. With vetKeys, developers can seamlessly integrate end-to-end encryption into their applications, ensuring sensitive data stays protected even on a public blockchain.

Sources
DFINITY: The Internet Computer's Privacy Era, vetKeys Unlocked
DFINITY vetKeys GitHub Repository
DFINITY Foundation Launches Niobium Milestone