Trusted Execution Environment (TEE)
A secure, isolated area within a computer's processor that runs code and handles data in a way shielded from the rest of the system, including its own operating system.
A Trusted Execution Environment is a secure, isolated region within a computer's hardware, typically built into the processor, that executes code and handles sensitive data in a way that's cryptographically shielded from the rest of the system — including, critically, from the device's own operating system and any other software running on it. Code and data inside a TEE can be verified as genuinely running inside that protected environment through a process called remote attestation.
In crypto applications, TEEs are sometimes used as part of a wallet's key-management approach, as an alternative or complement to secure multi-party computation techniques like an MPC wallet (see Kaavon's "MPC Wallet" glossary definition), and in some oracle and off-chain-computation designs where sensitive data needs to be processed without exposing it even to the machine's own operator. The main tradeoff is that TEE security ultimately depends on trusting the hardware manufacturer's implementation to be free of flaws, and TEE implementations have at times been found to have exploitable vulnerabilities, meaning the "trusted" in the name reflects a specific, non-absolute trust assumption rather than a mathematical guarantee.
Examples
- A wallet provider might use a device's TEE to handle a user's private key operations in a way shielded even from the device's own operating system.
- TEE security depends on trusting the underlying hardware implementation, which is a meaningfully different trust assumption than the mathematical guarantees of a cryptographic scheme like MPC.