# Is vetKD secure for personal data without AMD SEV?

**URL:** <https://forum.dfinity.org/t/is-vetkd-secure-for-personal-data-without-amd-sev/22789>\
**Category:** Developers\
**Created:** [September 8, 2023, 5:15am UTC](https://forum.dfinity.org/t/is-vetkd-secure-for-personal-data-without-amd-sev/22789 "2023-09-08T05:15:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tokuryoo](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/tokuryoo/32/3369_2.png) [@tokuryoo](https://forum.dfinity.org/u/tokuryoo)\
**Post date:** [September 8, 2023, 5:15am UTC](https://forum.dfinity.org/t/is-vetkd-secure-for-personal-data-without-amd-sev/22789/1 "2023-09-08T05:15:16Z")

</div>

Hi everyone,  
Using vetKD, it is possible to achieve end-to-end encryption. I had assumed that AMD SEV would be required to secure private information, but I may be mistaken given what was written below:

[vetKeys: technology overview](https://internetcomputer.org/docs/current/developer-docs/integrations/vetkeys/technology-overview)

> The nodes in the blockchain assist a user in recovering their root key, but never see that key or the content of the files.

Is it secure to handle personal information using only vetKD without AMD SEV?

---

<div class="post-metadata">

**Author:** ![NathanosDev](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/nathanosdev/32/7204_2.png) [@NathanosDev](https://forum.dfinity.org/u/NathanosDev)\
**Post date:** [September 8, 2023, 8:18am UTC](https://forum.dfinity.org/t/is-vetkd-secure-for-personal-data-without-amd-sev/22789/2 "2023-09-08T08:18:36Z")

</div>

Hello!

Yes, the vet keys are (if used correctly) giving you a much higher level of privacy than SEV SNP. No individual replica has access to the full private key, only the client will be able to access the full private key.

When e2e encrypted in this way, even if a node provider (or some other malicious party that has gained access to the node) breaks through the SEV SNP enclave, they will not be able to decrypt the data.

---

<div class="post-metadata">

**Author:** ![tokuryoo](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/tokuryoo/32/3369_2.png) [@tokuryoo](https://forum.dfinity.org/u/tokuryoo)\
**Post date:** [September 11, 2023, 2:31am UTC](https://forum.dfinity.org/t/is-vetkd-secure-for-personal-data-without-amd-sev/22789/3 "2023-09-11T02:31:48Z")

</div>

@NathanosDev  
Thanks for your reply.

vetKD is wonderful!

When e2e encrypted in this way, Since smart contracts cannot read the plaintext, can’t they process that data? If not, is a SEV SNP required?

---

<div class="post-metadata">

**Author:** ![skilesare](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/skilesare/32/5609_2.png) [@skilesare](https://forum.dfinity.org/u/skilesare)\
**Post date:** [September 11, 2023, 2:12pm UTC](https://forum.dfinity.org/t/is-vetkd-secure-for-personal-data-without-amd-sev/22789/4 "2023-09-11T14:12:02Z")

</div>

Yes…if you want the smart contract to calculate over the data without the node provider having theoretical access, then SEV SNP will be required.

One alternative is to use vet keys that can issue a decryption key to a trusted party. For enterprise applications, this should be reasonable. In fact, the space could really use a utilized trusted partner like this that takes all the headaches out of providing something like this.

---

<div class="post-metadata">

**Author:** ![tokuryoo](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/tokuryoo/32/3369_2.png) [@tokuryoo](https://forum.dfinity.org/u/tokuryoo)\
**Post date:** [September 12, 2023, 5:49am UTC](https://forum.dfinity.org/t/is-vetkd-secure-for-personal-data-without-amd-sev/22789/5 "2023-09-12T05:49:43Z")

</div>

@skilesare

> Yes…if you want the smart contract to calculate over the data without the node provider having theoretical access, then SEV SNP will be required.

Thanks for your reply. I understood.

> One alternative is to use vet keys that can issue a decryption key to a trusted party. For enterprise applications, this should be reasonable.

I am interested in Enterprise, but I’m not in a rush. Thanks for the alternative.
