Struct SealClient 

pub struct SealClient { /* private fields */ }

Client for seal/unseal operations in the TEE via RA-TLS.

Connects to the guest’s RA-TLS attestation server, verifies the TEE during the TLS handshake, then sends seal/unseal requests over the encrypted channel. The guest performs the actual crypto using keys derived from its TEE identity (measurement + chip_id).

Implementations

impl SealClient

pub fn new(socket_path: &Path) -> Self

Create a new seal client for the given attestation socket.

pub async fn seal( &self, data: &[u8], context: &str, policy: &str, attestation_policy: AttestationPolicy, allow_simulated: bool, ) -> Result<SealResult>

Seal data inside the TEE via RA-TLS.

1. Connects to the guest attestation server
2. TLS handshake verifies the TEE
3. Sends plaintext (base64) over the encrypted channel (Frame protocol)
4. Guest encrypts with AES-256-GCM bound to TEE identity

Arguments

• data - Raw data to seal
• context - Application-specific context for key derivation
• policy - Sealing policy name (“MeasurementAndChip”, “MeasurementOnly”, “ChipOnly”)
• attestation_policy - Attestation policy for TEE verification
• allow_simulated - Whether to accept simulated TEE reports

pub async fn unseal( &self, blob: &str, context: &str, policy: &str, attestation_policy: AttestationPolicy, allow_simulated: bool, ) -> Result<Vec<u8>>

Unseal data inside the TEE via RA-TLS.

1. Connects to the guest attestation server
2. TLS handshake verifies the TEE
3. Sends sealed blob over the encrypted channel (Frame protocol)
4. Guest decrypts with the TEE-bound key

Arguments

• blob - Base64-encoded sealed blob
• context - Context used during sealing
• policy - Sealing policy used during sealing
• attestation_policy - Attestation policy for TEE verification
• allow_simulated - Whether to accept simulated TEE reports

Trait Implementations

impl Debug for SealClient

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.