vetkd

Implement vetKeys encryption and key derivation for Internet Computer canisters.

28|11|Updated Feb 25, 2026
One-click install
npx skills add https://github.com/dfinity/icskills --skill vetkd
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: vetkd
Source: https://github.com/dfinity/icskills/tree/main/skills/vetkd
Command: npx skills add https://github.com/dfinity/icskills --skill vetkd

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill enables secure, on-chain encryption and privacy for Internet Computer applications by leveraging the vetKD protocol for verifiable, encrypted, and threshold key derivation.

Core Features & Use Cases

  • On-chain Privacy: Encrypt sensitive data directly on the blockchain.
  • Verifiable Key Derivation: Ensure keys are derived correctly and without tampering.
  • Identity-Based Encryption (IBE): Encrypt messages to specific identities (principals) without prior key exchange.
  • Use Case: Securely store user data on-chain, implement private messaging systems, or enable decentralized key management for sensitive operations.

Quick Start

Use the vetkd skill to derive a public key for a given context and canister ID.

Frequently Asked Questions about vetkd

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I encrypt sensitive data directly on the Internet Computer?

On-chain encryption for Internet Computer canisters is achieved using the vetKD protocol for verifiable, encrypted, and threshold key derivation. It enables secure data confidentiality directly on the blockchain without exposing private keys to individual nodes.

What is identity-based encryption and how does it work for canisters?

Identity-Based Encryption (IBE) allows canisters to encrypt messages directly to specific user principals without prior key exchange. The vetKD protocol handles verifiable threshold key derivation on-chain to securely enable this targeted data privacy.

How do I derive a public key for a specific canister context?

You derive a public key for a specific canister context by implementing the vetKD protocol's key derivation process. This generates verifiable threshold keys tailored to your canister ID and specific application access control requirements.

Can I implement access control using verifiable threshold key derivation?

Yes, you can implement access control using verifiable threshold key derivation. The vetKD protocol ensures keys are derived correctly without tampering, allowing canisters to securely manage decryption permissions for sensitive on-chain operations.

Does the Internet Computer support on-chain private messaging without prior key exchange?

Yes, the Internet Computer supports on-chain private messaging without prior key exchange using the vetKD protocol. It leverages Identity-Based Encryption to securely target specific principals, enabling decentralized key management for confidential communication.