There is a lot of information about the recent TEE changes in a lot of places. Also the Dfinity team seems to be moving really fast and it’s hard to keep up, great job!
I’ve conducted an indepentent research on the dfinity/ic codebase - master:b8c2185. Take it with a grain of salt - this research is mostly done by AI, it would haven taken months otherwise.
This doesn’t mean that currently all nodes have it activated, just that the code is there.
24 pages PDF research/ic_privacy_ai_research.pdf at main · Neutrinomic/research · GitHub
TL;DR
No. Your messages and canister data are private.
| What | Private? | Why |
|---|---|---|
| Messages you send to canisters | YES | TLS in transit, SEV-SNP at rest |
| Messages canisters send back | YES | TLS in transit, SEV-SNP at rest |
| Data stored in canisters | YES | SEV-SNP + encrypted disk (keys derived from hardware) |
| Canister memory & state | YES | Never leaves hardware-protected enclave |
Who can read your data?
| Who | Can they? | Why not |
|---|---|---|
| Node operators | NO | SSH disabled in production |
| Data center staff | NO | Memory encrypted by AMD CPU |
| Hackers on the network | NO | TLS 1.3 encryption |
| DFINITY | NO | No backdoors, no special access |
Bottom line: Your browser ↔ canister communication is encrypted end-to-end. The plaintext only exists inside hardware enclaves (SEV-SNP) where no human has access. Even canister state on disk is encrypted with keys that only exist inside the enclave.
IC is up to date in the following table, other chains may not be
IC potentially capable of supporting compliance with the following ISO standards.
- ISO/IEC 27001 — Information Security Management Systems (ISMS)
- ISO/IEC 27002 — Information Security Controls
- ISO/IEC 27017 — Cloud Security Controls
- ISO/IEC 27018 — Protection of Personally Identifiable Information (PII) in Public Clouds
- ISO/IEC 27701 — Privacy Information Management System (PIMS)
- ISO 27799 — Health Informatics — Information Security Management in Health
- ISO/IEC 62304 — Medical Device Software — Software Life Cycle Processes
- ISO/IEC 80001-1 — Risk Management for IT Networks Incorporating Medical Devices
- ISO/IEC 25010 — Systems and Software Quality Models
- ISO/IEC 15408 — Common Criteria for Information Technology Security Evaluation