The Internet Computer just crossed a huge milestone in blockchain privacy. For the first time ever, smart contracts can now run with fully confidential state and computation, which means that not even the machines running the code and files can peek inside.
Key Concepts
- TEE: Think of it as a vault built directly into the CPU that even the machine’s owner can’t crack open.
- SEV-SNP: AMD’s specific implementation of TEE technology.
- Subnet: On ICP, a subnet is a group of node machines that work together to host and run smart contracts.
DFINITY Proposes Another Industry Game Changer
You might be surprised about this, but in blockchain, encrypting data is the easy part. The hard part is PROCESSING that data while keeping it private. Traditional blockchains handle this by encrypting data while it’s not being used, but the second you need to actually do something with that data, for example run a calculation, or execute a smart contract, you have to decrypt it. And the instant you decrypt it, whoever is running that computation can see everything.
That’s why TEE (Trusted Execution Environment) changes everything. With TEE technology, specifically AMD’s SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging), the hardware itself creates an encrypted bubble where computation happens. The data gets decrypted inside this secure vault, processed, the results come out, but at no point can anyone outside that vault see what’s happening inside, not even the person who owns the physical machine.
ICP has been testing this technology for months. As DFINITY researcher rbirkner explained in the forum announcement, individual TEE nodes have been successfully running in all roles: unassigned, replica, and API boundary nodes. Now, with Proposal 140407, those tested nodes are coming together to form a complete subnet dedicated to confidential computation.
Less Nodes, Better Security
This subnet only uses seven nodes instead of the usual thirteen that is usual for ICP. That might sound like less security, but it’s actually quite the opposite. Because TEE nodes provide hardware-backed security guarantees, fewer nodes are needed to achieve the same or even better security level. The hardware is doing heavy lifting that would normally require more machines and more consensus rounds.
These seven nodes are spread across the world: Australia, Costa Rica, Czech Republic, Spain, Hong Kong, India, and the United States. Right now, this subnet is operating in “authorized-only” mode. No deployments are permitted yet. DFINITY is gathering operational experience, making sure everything runs smoothly before opening it up. Once they’ve confirmed stability, the plan is to either open this subnet for general use or create additional TEE subnets based on what they learn.
How SEV-SNP Actually Works
Let me break down the technology powering this subnet. AMD’s SEV-SNP isn’t new. Major cloud providers like AWS, Google Cloud, and Azure already use it for confidential computing workloads. But using it in a decentralized blockchain context is novel.
SEV-SNP encrypts the entire memory space of a virtual machine using keys generated by AMD’s secure processor. Even if someone compromises the hypervisor (the software that manages virtual machines), they can’t read the encrypted memory. Even if they have physical access to the machine, they still can’t extract the data.
But encryption alone isn’t enough. SEV-SNP also provides memory integrity protection. This means if a virtual machine reads a memory page, it’s guaranteed to only get the last value that was written there. No substitutions, tampering, or replay attacks. This protection extends to preventing the hypervisor from remapping or swapping memory pages between different VMs, closing off an entire class of side-channel attacks.
The system also includes something called cryptographic attestation. Before you trust a TEE with your sensitive data, you can verify that it’s actually running in a genuine secure environment with the correct, unmodified code. The TEE generates an attestation report signed by AMD’s hardware, proving its integrity. In other words, you’re getting a cryptographic proof from the chip itself.
ICP’s Privacy Approach (Two Steps)
What makes the Internet Computer’s privacy compelling is that TEEs aren’t the only tool in the box. ICP already launched vetKeys in July 2025, providing cryptographic privacy through verifiable encrypted threshold key derivation. I know this is very technical, but bear with me.
vetKeys enable identity-based encryption where you can encrypt data for a specific user (identified by their principal, Internet Identity, or even an Ethereum address) without that user needing to have interacted with your application before. The keys are derived on-demand by subnet nodes using threshold cryptography. No single node ever has access to a complete private key. This enables use cases like end-to-end encrypted messaging, private password managers, and MEV-proof DeFi where transaction details stay hidden until they’re finalized on-chain.
Now with TEE subnets, ICP offers a complementary approach: hardware-backed confidential computation. Where vetKeys provide cryptographic privacy that’s verifiable through mathematics, TEEs provide confidential execution environments verified through the hardware itself.
Think of it this way: vetKeys are like having an unbreakable encryption algorithm, while TEEs are like having a locked room where you can safely use that algorithm without anyone watching over your shoulder. They are different tools, but both are essential for different use cases.
Real World Use Cases
Privacy on public blockchains has always been the dealbreaker for enterprise adoption. CZ actually said this exact thing in a recent post. For organizations dealing with regulations like GDPR, public blockchains have always been a no-go.
TEE subnets change that, because now you can build applications that require genuine confidentiality. Let me give you some examples:
Healthcare and Medical Records: Hospitals could share patient data for research or coordinated care while keeping individual records completely private. The computation happens inside the TEE, results are shared, but no one outside the secure vault ever sees the sensitive medical information.
Private DeFi and Trading: One of the issues with DeFi are MEV attacks, where bots can see pending transactions and front-run them for profit. With confidential computation, trade details can be encrypted until they’re finalized.
AI and Machine Learning: Training AI models requires massive datasets, often containing sensitive information. TEE subnets could enable collaborative AI training where multiple parties contribute proprietary data, the model trains on the combined dataset inside the secure vault, and no party ever sees the others’ raw data.
Enterprise Applications: Any business process involving confidential information: payroll, contracts, supply chain data with competitive implications, all of these become feasible on a public blockchain when you can guarantee that the computation remains private.
Confidential (Real Life) Governance: Private voting where votes are encrypted inside a TEE, and only the final results published. Participants can verify the process was fair through attestation without anyone knowing how individuals voted.
All of these are real life applications that are absolutely mindblowing if you think about them being implemented in our societies. I will dedicate a whole article to expand on these further and give you guys some concrete insights on how this can change the world for the better.
TEE vs Zero-Knowledge
It’s worth knowing how TEE privacy compares to other approaches, particularly zero-knowledge proofs, which have gotten a lot of attention in the crypto space, especially with the Ethereum community.
Zero-knowledge proofs let you prove something is true without revealing why it’s true. They’re powerful for specific use cases like proving you have enough funds for a transaction without revealing your balance, or proving you’re over 21 without revealing your birthdate. But ZK-proofs come with tradeoffs. They’re computationally expensive to generate, they often require custom circuits designed for each specific use case, and they’re not suited for general-purpose computation with large datasets.
TEEs take a different approach. Instead of mathematically proving computation happened correctly without revealing the data, TEEs create a protected environment where computation happens normally but remains hidden. This makes them more flexible for complex, general-purpose applications.
The performance difference is significant. For something like a decentralized exchange handling thousands of transactions with complex order matching logic, building that with zero-knowledge proofs would be extremely challenging and computationally expensive. With TEEs, you can run that same logic at near-native speeds inside the secure vault. That said, TEEs and ZK-proofs aren’t competitors, but complementary.
The Internet Computer providing both TEE-based hardware privacy and vetKeys-based cryptographic privacy gives developers options to choose the right tool for their specific needs.
Conclusion
If you’ve been holding ICP since the early days (shoutout to my fellow 8-year gang members), you’ve watched this protocol evolve from a fascinating technical experiment into something that’s starting to solve real problems that have blocked blockchain adoption.
Privacy has always been the missing piece of the puzzle. TEE subnets remove that barrier. Combined with vetKeys, Chain Fusion, and ICP’s existing capabilities for running full-stack applications entirely on-chain, the Internet Computer offers something genuinely different from other blockchains: a platform where you can build privacy focused, enterprise-grade applications without sacrificing decentralization.
Every application running on ICP burns ICP to create cycles. More applications, especially enterprise applications with serious usage, means more burn. More burn means downward pressure on supply. Confidential computing opens up entire categories of applications that couldn’t exist on public blockchains before, expanding the potential market for ICP services.
If you made it this far, thank you for reading. And if you want more extensive ICP articles such as this one delivered straight to your inbox, consider subscribing to my Substack.
Talk to you later. BasedGiant.
Sources + Further Reading
NNS Proposal 140407 - The governance proposal creating the first TEE subnet
DFINITY Forum Announcement - Official announcement with technical details and decentralization metrics
Bjoern Tackmann on X - DFINITY researcher’s announcement about confidential smart contracts
What are vetKeys? - Official documentation on ICP’s cryptographic privacy technology
Onchain Privacy in Action: A Guide to vetKeys Use Cases - DFINITY’s overview of privacy use cases
What is a Trusted Execution Environment (TEE)? - General background on TEE technology
AMD SEV-SNP Overview - Amazon’s announcement of SEV-SNP support showing enterprise adoption
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.