Identity and Cryptography

Each enrolled Enclave system has an identifier (for example, V88RY or 968K2). These identifiers come from each system's certificate.

When you enrol a system, the installed agent issues a certificate signing request to the Enclave platform, along with an Enrolment Key retrieved from your portal account. Provided the key is valid (and the enrolment attempt meets the correct conditions), the Enclave platform issues a signed certificate.

An example certificate provided after enrolment:

"Certificate": {
    "Version": 0,
    "SerialNumber": "n7JLyhs/mUivvK1ALOnxjA==",
    "PermittedUse": "Endpoint",
    "SubjectDistinguishedName": "R8WLQ",
    "SubjectPublicKey": "GwkfXjwAqxJheLzVWhF+V8JEa0R9od74ysQfC6i2Yas=",
    "NotBefore": 1673538715,
    "NotAfter": -1,
    "IssuerDistinguishedName": "Enclave Networks Primary Intermediate G1",
    "IssuerPublicKey": "WwZg4p39Swi3J/z/XfqWPV1Ld466U0VVr11x8bclPOs=",
    "Signature": "rVEmjvZUbiaa7SSnfdYPhV87tGWI1B3Sdrn2kU2Ir/Wj2XSdId1IwxAi3GXgRPEbH2LPlH8ysWe5jLvhLf99Dg=="
},

Enclave does not represent certificates in X.509 format. You can find your certificate in your profile file.

The Subject Distinguished Name is a globally unique identifier for the system, generated during certificate signing, that is used to reference it in APIs and the portal.

See Profile files for the location of this file on each platform.

Signatures are generated using the Ed25519 EdDSA algorithm. The 256-bit private keys for a given certificate are generated locally on the agent (and never leave the device).

Enclave takes steps on each platform to reduce the chance of private key exfiltration, including machine encryption with DPAPI on Windows, secure storage on mobile devices, and root-only file permissions on Linux.

Info

Enclave uses the industry standard library libsodium for cryptographic primitives.

System/Certificate Revocation

When you remove a system in the Enclave Portal, or via the API, it permanently revokes that system's certificate; the system will no longer be introduced to any other systems by the discovery service, regardless of the effective policies. Systems that have been revoked must be re-enrolled to get connectivity back.

Key Exchange

Every time a tunnel comes up between two peers, Enclave uses the Curve25519 ECDHE key agreement algorithm to generate brand new per-session keys, providing perfect forward-secrecy, and ensuring that no other party is able to decrypt the data stream between two peers.

The Curve25519 algorithm provides a 256-bit shared secret, which is then expanded into two separate 256-bit secrets, one for each direction of transmission between peers.

Tunnel Encryption

On platforms that support AES256 hardware acceleration (requires Intel SSSE3, aesni and pclmul instructions), tunnel encryption uses AES256-GCM AEAD with a 128-bit block size and a 96-bit counter nonce, non-repeating and monotonically incrementing. Enclave switches to a new key before reaching 2^36 bytes or 2^32 messages encrypted with the same key.

On any platform that does not support hardware acceleration, Enclave uses ChaCha20-Poly1305 AEAD, with a 512-bit internal state, a 64-bit counter nonce, non-repeating and monotonically incrementing. Enclave switches to a new key before reaching nonce re-use with the same key.

Summary

Cryptographic algorithms used by Enclave:

Purpose	Algorithm	Key Size	HW Acceleration Required
Public-key signatures	Ed25519	256 bits	No
Key Exchange	Curve25519		No
Tunnel Encryption	AES256-GCM	256 bits	Yes
Tunnel Encryption	ChaCha20-Poly1305	256 bits	No

Last updated August 1, 2026