Decryption & Attestations
Theis_validsignature function verifies Ed25519 signatures for attested decryption results from the covalidator network.
On-Chain Verification
How Attestation Works
Complete Attested Decryption Flow
Summary
- Request decryption: Client requests decryption of a handle they have access to
- Covalidator processes: The covalidator network decrypts the value in a TEE
- Sign attestation: Covalidator signs
hash(handle + plaintext_value)with Ed25519 - Verify on-chain: Program verifies the signature using
is_validsignature
Verification Parameters
Account Requirements
The verification requires access to the instructions sysvar:The Ed25519 signature must be provided in a previous instruction in the same transaction. The
is_validsignature function verifies against the instructions sysvar.Client-Side Decryption
Decryption is initiated client-side using the JavaScript SDK. The SDK handles requesting decryption from the covalidator:ed25519Instructions from the result to build a verification transaction. See Attested Decrypt for details.
Attested Compute
When you only need a predicate (for examplebalance >= 100) without revealing the raw plaintext, use Attested Compute. The covalidator still requires on-chain allowance for the caller, evaluates the comparison off-chain, and returns a signed "0" / "1" result you can optionally verify on-chain.
Allowance Voucher / Session Key
To decrypt or compute without a wallet popup on every request, grant an Allowance Voucher to a session key. Coval still checks that the sharer has on-chain allowance for the handle.See the JavaScript SDK Attested Decrypt, Attested Compute, and Allowance Voucher docs for complete usage and examples.