Skip to main content

Decryption & Attestations

The is_validsignature function verifies Ed25519 signatures for attested decryption results from the covalidator network.

On-Chain Verification

How Attestation Works

Complete Attested Decryption Flow

Summary

  1. Request decryption: Client requests decryption of a handle they have access to
  2. Covalidator processes: The covalidator network decrypts the value in a TEE
  3. Sign attestation: Covalidator signs hash(handle + plaintext_value) with Ed25519
  4. Verify on-chain: Program verifies the signature using is_validsignature

Verification Parameters

Account Requirements

The verification requires access to the instructions sysvar:
The Ed25519 signature must be provided in a previous instruction in the same transaction. The is_validsignature function verifies against the instructions sysvar.

Client-Side Decryption

Decryption is initiated client-side using the JavaScript SDK. The SDK handles requesting decryption from the covalidator:
For on-chain verification of decrypted values, use the ed25519Instructions from the result to build a verification transaction. See Attested Decrypt for details.

Attested Compute

When you only need a predicate (for example balance >= 100) without revealing the raw plaintext, use Attested Compute. The covalidator still requires on-chain allowance for the caller, evaluates the comparison off-chain, and returns a signed "0" / "1" result you can optionally verify on-chain.

Allowance Voucher / Session Key

To decrypt or compute without a wallet popup on every request, grant an Allowance Voucher to a session key. Coval still checks that the sharer has on-chain allowance for the handle.
See the JavaScript SDK Attested Decrypt, Attested Compute, and Allowance Voucher docs for complete usage and examples.