skills.rest
phukrit7171
phukrit7171COMMUNITY
Explore all skills by this author →
𝕏@Phukrit7171GitHub

vetkd

Implement on-chain encryption on the Internet Computer using vetKeys threshold key derivation.

Updated Apr 3, 2026
Search Tags:#encryption#privacy#canister#internet computer#vetkeys#ibe#threshold cryptography
One-click install
npx skills add https://github.com/phukrit7171/Relationship-Smart-Contract-ICP --skill vetkd-phukrit7171
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vetkd
Source: https://github.com/phukrit7171/Relationship-Smart-Contract-ICP/tree/main/.agents/skills/vetkd
Command: npx skills add https://github.com/phukrit7171/Relationship-Smart-Contract-ICP --skill vetkd-phukrit7171

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ic-vetkeys, @dfinity/vetkeys, ic-cdk, candid.

What problem does it solve? Public blockchains cannot natively hold or work with secret data, making on-chain privacy, encrypted storage, and private messaging impossible without complex off-chain key management. This Skill guides you through implementing vetKeys (verifiable encrypted threshold key derivation) so a canister can derive encryption keys from the subnet's threshold infrastructure without any node or canister ever seeing the raw key. ## Core Features & Use Cases - Threshold Key Derivation: Call the management canister's vetkd_public_key and vetkd_derive_key system APIs from Rust or Motoko, with correct cycle payments and context/input separation. - Identity-Based Encryption (IBE): Encrypt messages to a principal offline using derived public keys; the recipient decrypts later with their vetKey, no prior key exchange needed. - High-Level Libraries: Use ic-vetkeys (Rust) and @dfinity/vetkeys (TypeScript) KeyManager and EncryptedMaps for access-controlled keys and encrypted key-value storage. - Use Case: Build an encrypted messaging dapp where users encrypt messages to each other's principals on-chain, and only the intended recipient can derive the key and decrypt locally in their browser. ## Quick Start Add vetKeys-based encryption to my ICP canister so users can encrypt and decrypt data with keys derived from their principal.

Frequently Asked Questions about vetkd

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add on-chain encryption to an ICP canister?▼

Use the vetKD system API on the management canister: call vetkd_public_key to get a verification key and vetkd_derive_key to derive key material encrypted under a client transport key. The ic-vetkeys Rust crate and @dfinity/vetkeys npm package provide higher-level KeyManager and EncryptedMaps abstractions.

What is the difference between vetkd_public_key and vetkd_derive_key?▼

vetkd_public_key returns a public key for verification or IBE encryption and costs no cycles. vetkd_derive_key returns key material encrypted under the caller's transport public key, costs cycles (about 26B for key_1, 10B for test_key_1), and requires an async inter-canister call.

Can I use vetKeys for user authentication?▼

No, vetKeys is for key derivation and encryption, not authentication. Use Internet Identity for authentication, then use vetKeys to derive encryption keys scoped to the authenticated principal for private data access.

Why does vetKeys decryption fail silently in my frontend?▼

The most common cause is inconsistent context strings: if the backend uses b"my_app_v1" but the frontend verifies with b"my_app", derived keys will not match. Also confirm you decrypt the encrypted blob with the transport secret and derive an AES key via toDerivedKeyMaterial() rather than using raw bytes directly.

How do I test vetKD locally without paying mainnet fees?▼

The local icp network provisions test_key_1 automatically, so vetKD calls work in local development. On mainnet you can use test_key_1 at lower cost, or the chain-key testing canister vrqyr-saaaa-aaaan-qzn4q-cai with insecure_test_key_1, which is insecure and for testing only.

Is it safe to put secret data in the vetKD input field?▼

No, the input field is sent in plaintext to the management canister and serves only as a key identifier, such as a principal or document ID. Never place secret payload data in input; encrypt secrets with the derived key instead.

Related Skills

Explore More Software Engineering Skills→
dfinitydfinity
28

internet-identity

Integrate Internet Identity authentication for Internet Computer apps with passkey and OpenID flows.

Official
Intermediate
dfinitydfinity
28

vetkd

Implement vetKeys encryption and key derivation for Internet Computer canisters.

Official
Advanced
Pact-Community-OrganizationPact-Community-Organization
1

pact-guards

Implement and verify Pact guards for access control in smart contracts.

Official
Advanced
Negentropy-LabyNegentropy-Laby
3

changelog

Generate structured internal changelogs from git commits, sprint reports, and design documents.

Official
Advanced