TeeFree: Secure Computation Without TEEs

Executive Summary

TeeFree replaces Trusted Execution Environments (Intel SGX, AMD SEV, ARM TrustZone) with information-theoretic security that requires no specialized hardware, no vendor attestation, and no trust in chip manufacturers.

The core technology is XorIDA threshold secret sharing over GF(2) — the same cryptographic primitive powering all 140 ACIs on the PRIVATE.ME platform. Instead of isolating computation inside a hardware enclave, TeeFree splits sensitive data into mathematically independent shares. Any K-of-N shares can reconstruct the original. Fewer than K shares reveal exactly zero information — not hard to break with enough computing power, but provably impossible regardless of adversary capability.

When computation is required, TeeFree coordinates multi-party computation (MPC) across N worker nodes. Each node processes its share without ever seeing plaintext. Results reconstruct only after K nodes complete their work and verify integrity via HMAC. No single node learns the input, intermediate state, or output alone.

Performance is competitive with hardware TEEs for typical workloads: sub-millisecond overhead for data-at-rest splitting, ~5ms for 2-of-3 threshold with HMAC, ~180x faster than traditional MPC via Xchange mode. Scales horizontally across commodity x86, ARM, RISC-V — no vendor lock-in, no attestation infrastructure, no microcode updates.

The Problem With Hardware TEEs

Trusted Execution Environments promise confidential computing but introduce vendor dependency, side-channel vulnerabilities, and a trust model incompatible with true zero-trust architectures.

Vendor Lock-In

Intel SGX requires specific Intel CPUs with SGX-enabled firmware. AMD SEV requires EPYC processors. ARM TrustZone requires ARM-based chips. You trust the chip vendor to implement the TEE correctly, patch vulnerabilities promptly, and not insert backdoors. Multi-cloud deployments become fragmented — SGX on AWS Nitro, SEV on Azure Confidential Computing, TrustZone on mobile. No portability.

Side-Channel Attacks

Hardware TEEs are vulnerable to side-channel attacks: Spectre, Meltdown, Foreshadow, SGAxe, CacheOut, Load Value Injection. Each vulnerability requires firmware updates, attestation re-verification, and potential service restarts. Theoretical security != practical security. TeeFree has no speculative execution, no shared cache, no microarchitectural state to leak.

Attestation Overhead

Remote attestation verifies that a TEE is running unmodified code on genuine hardware. This requires network calls to vendor attestation services (Intel IAS, AMD Key Distribution Service), PKI infrastructure, and constant re-attestation as firmware updates roll out. Latency penalty: 50-200ms per attestation. TeeFree replaces attestation with HMAC verification — local, instant, cryptographically sound.

Limited Memory

SGX enclaves have strict memory limits (128MB EPC on v1, 256MB on v2, still limited on v3). Exceeding EPC triggers paging to untrusted memory with 10-100x slowdown. AMD SEV has looser limits but still caps encrypted memory regions. TeeFree has no memory constraints — shares are ordinary byte arrays processed on standard RAM.

Use Cases

Six scenarios where TeeFree replaces hardware TEEs with information-theoretic security on commodity infrastructure.

Solution Architecture

Three layers: XorIDA splitting (data-at-rest), MPC orchestration (computation), and HMAC verification (integrity).

How It Works

Step-by-step: from plaintext to secure distributed computation and reconstruction.

Data-at-Rest: XorIDA Splitting

Client generates K=2, N=3 shares from plaintext payload using XorIDA over GF(2). Each share is the same size as the plaintext. Shares are individually random and reveal zero information. An HMAC key is also split and distributed alongside each share.

import { teeFree } from '@private.me/crypto';

const sensitive = { ssn: '123-45-6789', balance: 50000 };
const result = await teeFree.split(sensitive, { threshold: 2, totalShares: 3 });

// result.shares = [share0, share1, share2]
// Any 2 shares reconstruct. 1 share reveals nothing.
const reconstructed = await teeFree.reconstruct([result.shares[0], result.shares[2]]);

Computation: MPC Across Shares

Shares route to N geographically distributed worker nodes. Each node runs the same computation function on its share without ever seeing plaintext. Intermediate results remain encrypted as shares. Only after K nodes complete and verify HMACs does reconstruction happen.

// Node 0 receives share[0], Node 1 receives share[1], Node 2 receives share[2]
const computeFn = (share) => {
  // Process share (e.g., aggregate, filter, transform)
  return processShare(share);
};

const resultShares = await teeFree.compute({
  shares: [share0, share1, share2],
  fn: computeFn,
  threshold: 2,
  nodes: ['https://node0.example.com', 'https://node1.example.com', 'https://node2.example.com'],
});

// resultShares = outputs from each node, still as shares
// Reconstruct only after K nodes verify HMAC
const finalResult = await teeFree.reconstruct(resultShares, { verifyHMAC: true });

Integrity: HMAC-Before-Reconstruct

Before reconstruction, TeeFree verifies HMAC-SHA256 on each share. If any share fails HMAC verification, reconstruction aborts with HMAC_VERIFICATION_FAILED. This prevents tampering — an attacker who modifies a share without the HMAC key cannot forge a valid MAC.

Performance

Sub-millisecond splitting, competitive MPC latency, horizontal scaling with no hardware bottlenecks.

Integration

Three integration patterns: library mode (direct API), service mode (REST API), and MPC orchestration (distributed compute).

Library Mode

Import @private.me/crypto and call teeFree.split() directly in application code. Ideal for single-process workloads where you control share distribution.

import { teeFree } from '@private.me/crypto';

const { shares } = await teeFree.split(payload, { threshold: 2, totalShares: 3 });
// Store shares[0] locally, shares[1] on backup, shares[2] on DR site

Service Mode (REST API)

Deploy TeeFree as a microservice. Clients POST plaintext to /teefree/split, receive shares. Shares route to worker nodes for computation. Results POST back to /teefree/reconstruct.

# Split
curl -X POST https://teefree.example.com/split \
  -H 'Content-Type: application/json' \
  -d '{"payload": {"secret": "data"}, "threshold": 2, "totalShares": 3}'

# Returns: {"shares": ["base64-share0", "base64-share1", "base64-share2"]}

# Reconstruct
curl -X POST https://teefree.example.com/reconstruct \
  -H 'Content-Type: application/json' \
  -d '{"shares": ["base64-share0", "base64-share2"], "verifyHMAC": true}'

# Returns: {"payload": {"secret": "data"}}

MPC Orchestration

For distributed computation, integrate @private.me/xcompute alongside TeeFree. Xcompute provides 3-party MPC with SPDZ-inspired IT-MAC protocol. Each party holds a share, computation happens on shares, results reconstruct only after all parties verify integrity.

import { teeFree } from '@private.me/crypto';
import { xcompute } from '@private.me/xcompute';

const { shares } = await teeFree.split(sensitive, { threshold: 2, totalShares: 3 });

// Each party runs computation on its share
const results = await xcompute.run({
  shares,
  fn: aggregateFunction,
  parties: [party0, party1, party2],
  threshold: 2,
});

// results = final output after MPC completes

Security Guarantees

Information-theoretic security proven via Shannon's perfect secrecy theorem. Zero computational assumptions.

Information-Theoretic Security

XorIDA operates over GF(2) (binary field). For a K-of-N threshold scheme, any K-1 or fewer shares reveal exactly zero bits of information about the plaintext. This is not a computational hardness assumption — it is a mathematical proof via Shannon entropy. No adversary, regardless of computing power (including quantum computers), can extract information from K-1 shares.

Defense Against Collusion

TeeFree is secure as long as fewer than K nodes collude. For K=2, N=3, an attacker must compromise at least 2 nodes simultaneously to reconstruct plaintext. Independent node compromise (e.g., Node 0 on Monday, Node 1 on Wednesday) does not break security if shares are rotated between compromises.

HMAC Integrity Protection

Every share carries HMAC-SHA256 computed over the share data. Tampering with a share without the HMAC key results in verification failure. TeeFree never reconstructs from unverified shares — this is enforced at the protocol level.

Threat Model

Benchmarks

Measured on commodity x86 (Intel i7-12700) and ARM (Apple M2). All benchmarks include HMAC verification overhead.

Honest Limitations

TeeFree is not a drop-in replacement for all hardware TEE use cases. Know the tradeoffs.

Requires K-of-N Node Availability

Reconstruction requires at least K shares available. If K nodes are offline simultaneously, reconstruction fails. Hardware TEEs run on a single machine and don't require coordination. Mitigation: Set K < N to tolerate N-K failures. For 2-of-3, any single node can be offline without blocking reconstruction.

Not Suitable for Low-Latency Single-Node Workloads

If your workload is latency-critical and cannot tolerate network round-trips to K nodes, hardware TEEs on a single machine may be faster. TeeFree shines when security trumps single-digit-millisecond latency or when TEE hardware is unavailable (mobile, edge, IoT).

MPC Overhead for Complex Computation

Secure multi-party computation on shares is slower than plaintext computation inside a TEE. Simple aggregates (sum, count, average) are fast. Complex logic (joins, graph algorithms, ML training) can be 10-100x slower than plaintext. Mitigation: Use hybrid architecture — compute on plaintext inside a TEE-free node, split results via XorIDA for distribution.

Share Storage Overhead

N shares require N times the storage of the original plaintext. For a 2-of-3 scheme, you store 3x the data. Hardware TEEs store plaintext once. Mitigation: Storage is cheap. Security is not. If 3x storage cost is prohibitive, TeeFree may not be the right fit.

TEE Comparison Matrix

Side-by-side comparison of TeeFree vs. Intel SGX, AMD SEV, ARM TrustZone, and AWS Nitro Enclaves.

Quantum Resistance

TeeFree is immune to quantum attacks because it makes zero computational assumptions. Hardware TEEs rely on RSA and ECDH, both broken by Shor's algorithm.

Hardware TEE Quantum Vulnerability

Intel SGX uses RSA-3072 for attestation and ECDH for key agreement. AMD SEV uses ECDH P-384. ARM TrustZone varies by implementation but typically uses ECDH or RSA. All of these are broken by Shor's algorithm on a sufficiently large quantum computer. Current estimates suggest 2030-2035 for cryptographically relevant quantum computers.

TeeFree: Information-Theoretic Immunity

XorIDA threshold sharing over GF(2) is unconditionally secure. There is no key to break, no discrete logarithm to solve, no factorization to compute. A quantum computer with infinite qubits and zero error rate still cannot extract information from K-1 shares. The security proof is based on Shannon entropy, not computational complexity.

API Surface

Core functions for split, reconstruct, compute, and verification.

import { teeFree } from '@private.me/crypto';

// Split plaintext into K-of-N shares
const { shares, hmacKey } = await teeFree.split(payload, {
  threshold: 2,
  totalShares: 3,
  includeHMAC: true,
});

// Reconstruct from K shares with HMAC verification
const result = await teeFree.reconstruct(shares, {
  verifyHMAC: true,
  hmacKey,
});

// Distributed computation via MPC
const mpcResult = await teeFree.compute({
  shares,
  fn: computeFunction,
  nodes: ['https://node0.example.com', 'https://node1.example.com'],
  threshold: 2,
});

// Verify share integrity (HMAC check without reconstruction)
const valid = await teeFree.verifyShare(share, hmacKey);

Deployment Patterns

Three deployment models: single-process, multi-region, and hybrid TEE.

Single-Process (Library Mode)

Import @private.me/crypto directly. Split data locally, store shares in different storage backends (local disk + S3 + GCS). Reconstruction happens in the same process. No network overhead. Suitable for workloads where you control all storage and don't need MPC.

Multi-Region (Distributed)

Deploy TeeFree nodes in N geographically separated regions (e.g., US-East, EU-West, APAC). Each node receives one share. MPC computation happens across regions. Results reconstruct only after K nodes verify and agree. Maximum resilience against regional outages and jurisdiction-specific seizure.

Hybrid TEE (Defense-in-Depth)

Run TeeFree inside hardware TEEs for defense-in-depth. Even if the TEE is compromised via side-channel, the attacker still needs K-1 other shares from other TEEs. Combines computational security (TEE) with information-theoretic security (TeeFree). Overkill for most use cases but viable for nation-state threat models.

Compliance & Regulatory Mapping

How TeeFree maps to HIPAA, PCI-DSS, GDPR, FedRAMP, and other frameworks.