Threshold cryptography vs TEEs for sealed bids
A sealed bid is only as private as the place its key lives before the deadline. A trusted enclave puts that key inside one chip. Threshold cryptography splits it so that no single machine has it. Here is what each one costs you when something goes wrong.
The question that decides it
Before the deadline, somebody can decrypt the bids. The design question is who that somebody is, how many of them must cooperate, and how you would find out if they did it early.
With a trusted execution environment (Intel SGX or TDX, AMD SEV-SNP), the key sits inside an enclave and the hardware promises that even the machine's owner cannot read it. You trust the chip vendor's design, its attestation service, and that nobody has found a way around either. With threshold cryptography, the key is split across a committee and a threshold of members must each contribute a share to decrypt. You trust that fewer than that many collude.
How each one fails
| trusted enclave | threshold committee | |
|---|---|---|
| what it takes to read bids early | one broken or misconfigured enclave | a threshold of members acting together; in Peal, 3 of 5 |
| would you notice? | usually not: a successful extraction leaves no public trace | not from the ciphertexts either, which is why the operators' independence is the whole guarantee |
| what it takes to stop the reveal | the enclave's operator going offline or refusing | enough members going offline that fewer than the threshold remain; in Peal, 3 of 5 absent |
| how a correct result is checked | an attestation report, signed by the vendor | each share is checked against the member's public key with a pairing equation that anyone can rerun |
| where the root of trust is | the chip vendor and the cloud it runs in | how the key was generated, and who runs the members |
The enclave track record
Enclaves fail by being broken quietly. In 2022, the SGX.fail research showed that Secret Network, which runs its confidential contracts in Intel SGX, was exposed to leaks that could reveal its consensus seed, the key behind every encrypted transaction on the chain; Secret froze new node registration while it responded. In 2025, TEE.fail used a memory-bus interposer costing under a thousand dollars to break attestation on Intel TDX, Intel SGX and AMD SEV-SNP, and demonstrated forged attestations against Flashbots' BuilderNet.
Flashbots' answer was that its operators must run in approved cloud environments, where an attacker has no physical access. That is a reasonable mitigation, and it is also a change in what you trust: the cloud provider joins the chip vendor. As of late September 2026, BuilderNet's own documentation says its nodes are "not running in TEEs" while it moves to a new security model. SUAVE, Flashbots' earlier TEE-based design, launched its Toliman testnet in 2023; we found no mainnet launch.
What threshold cryptography gives up
It is not free. A committee is slower to run than one enclave, it needs its members to be online at the deadline, and its guarantee rests on fewer than the threshold colluding. How the key is generated matters too, which is why distributed key generation, where no machine ever holds the whole key, is the standard to build towards.
How Peal does it
- No hardware to trust. Bids are opened with batched threshold encryption on BLS12-381. No step depends on an enclave, a chip vendor or an attestation service.
- Every share is checkable. Any 3 of 5 operators each publish one 48-byte share, and each one is verified with a public pairing equation that the explorer reruns in your browser.
- It keeps going when members drop out. Two operators can be offline and a round still opens. If fewer than three shares arrive within 120 seconds the round is marked stalled, and a late valid share still completes it.
- The whole batch opens at once. Every bid in a round becomes readable in the same instant, so no bidder or operator sees one before the others.
Peal's key shares are distributed among five operators, run by Peal during testnet, and in v1 they come from a distributed key generation.
When to choose which
- Choose threshold cryptography when the only thing that must stay secret is the bid until a deadline, when you want the reveal checkable without trusting a vendor's signature, and when you can rely on the committee being independent.
- Choose an enclave when you need to compute over private inputs, not just hold them, such as matching orders or running a builder, and you accept the vendor and the cloud as part of your trust model.
Questions
Is threshold cryptography or a TEE better for sealed auction bids?
For keeping bids secret until a deadline, threshold cryptography removes the single point of failure: reading early takes several independent parties instead of one broken enclave, and each decryption share can be checked publicly. A TEE is the better fit when you must compute over the bids privately, not just hold them.
Can a TEE operator stop an auction from revealing?
Yes. An enclave runs on someone's machine, and if that machine is offline or its operator refuses, the reveal does not happen. A threshold committee tolerates members going missing until fewer than the threshold remain.
Does Peal use a TEE?
No. Peal uses batched threshold encryption on BLS12-381. No step in sealing or opening depends on enclave hardware.
Sources: SGX.fail (2022) · TEE.fail (IEEE S&P 2026) · Flashbots on TEE.fail (Oct 2025) · BuilderNet docs · SUAVE Toliman testnet (2023) · Secret Network, Intel SGX.