What Is an E3?

Sensitive computation is usually secured by isolating it inside a trusted environment.

Trusted Execution Environments, or TEEs, take this approach in hardware. Systems built with Intel SGX, AWS Nitro Enclaves, and similar technologies create a boundary in which data can be decrypted and processed away from the rest of the machine. The security of the computation ultimately depends on that hardware boundary, the infrastructure running it, and the parties responsible for maintaining it.

An E3 begins from a different premise.

An Encrypted Execution Environment, or E3, is created for one shared computation. First introduced in the Interfold’s original whitepaper, E3s were designed as an alternative to persistent, hardware-based execution environments. Participants submit encrypted inputs to a defined program, a compute provider executes that program over the ciphertexts, and a ciphernode committee controls key generation and decryption collectively. Only the permitted result is decrypted.

Once the computation is complete, the E3 closes.

Rather than creating a persistent protected place, an E3 coordinates a temporary process: one program, one set of encrypted inputs, one ciphernode committee, one compute provider, one permitted result. The Interfold coordinates that process through programmable cryptography and blockchain coordination rather than trusted hardware.

Each E3 Exists for One Computation

An E3 is instantiated around a specific process.

That process might tally private ballots, clear a sealed-bid auction, calculate a statistic across sensitive datasets, or produce another shared result from private inputs.

The boundaries are established before participants submit their information:

These elements belong to that execution. They do not become part of an indefinitely running confidential environment.

This is what it means for E3s to be ephemeral by design. Each E3 remains active long enough to complete its defined process, then closes as an execution surface. Released results, proofs, and relevant onchain events may remain after closure, but the confidential environment itself does not.

The E3 Program Defines What Gets Computed

Every E3 runs an E3 program.

The program defines what should happen. A compute provider executes the encrypted computation, while the ciphernode committee controls key generation and threshold decryption. The Interfold coordinates these roles within one temporary E3.

An E3 program could define:

• how encrypted ballots are tallied
• how a sealed-bid auction determines its result
• how a statistic is calculated across private datasets
• how a model is evaluated against confidential inputs

Participants are therefore not depositing data into an open-ended pool. They are contributing encrypted inputs to a known computation operating under defined rules.

The program defines what should happen. The E3 provides the temporary encrypted environment in which it happens. The Interfold coordinates the network processes that allow the result to be produced without giving any one operator control of decryption.

The Five Phases of an E3

Each E3 moves through five phases.

1. Request

An E3 is requested for a defined computation. The request identifies the E3 program and establishes its operating conditions, including when inputs may be submitted and what the ciphernode committee must provide. These conditions define the process before any private inputs enter it.

2. Ciphernode Selection

A committee is formed to secure that E3. The selected ciphernodes collectively generate the encryption key used for the computation. Participants receive a shared public key with which to encrypt their inputs, while control of the corresponding secret remains distributed across the committee. No individual ciphernode holds the complete private key.

3. Input Window

Participants submit encrypted inputs to the E3. A voter might submit an encrypted ballot, a bidder an encrypted bid, or an institution encrypted information for a shared analysis. Inputs can also be checked against the program’s submission rules without revealing their underlying contents.

4. Execution

A compute provider executes the E3 program over the encrypted inputs. Once the input window closes, the selected compute provider runs the program without exposing the inputs or encrypted internal state as plaintext. It publishes an encrypted output together with the proof or validation required to show that the defined computation was executed correctly.

5. Threshold Decryption

The ciphernode committee decrypts only the permitted result. A threshold of committee members contributes valid decryption shares. No individual operator can decrypt the output alone. Once enough shares are available, they can be combined to recover the defined result. The committee’s duties then conclude, and the E3 closes.

What the Ciphernode Committee Does

Ciphernodes are the operator layer of the Interfold.

For each E3, a computation-specific subset of these operators forms a ciphernode committee. The committee participates in the threshold processes that prevent key control and decryption from concentrating in one machine or organization.

Its principal duties are:

• distributed key generation
• participation in computation-specific threshold duties
• threshold decryption of the permitted result

A committee is not the entire ciphernode network, nor is it a permanent custodian of the computation. Its membership and responsibilities are specific to one E3.

Individual ciphernodes do not receive the participants’ plaintext inputs, and no single committee member can independently decrypt the result. Their role is constrained by the E3 program, protocol rules, and the threshold conditions of that computation.

How Anyone Can Check the Result

Keeping information private is only part of the problem. Participants also need confidence that the shared result came from the computation they agreed to use.

An E3 can produce proof or validation that the defined process was followed without exposing the ballots, bids, or datasets underneath it.

Depending on the implementation, that proof or validation may cover:

• committee formation and distributed key generation
• whether encrypted inputs satisfy the program’s rules
• whether the E3 program executed correctly
• whether committee decryption shares are valid
• whether the decrypted result corresponds to the encrypted output

This is what allows private information to produce a public consequence. The result can be checked without making the inputs themselves part of the public record.

What Closes and What Remains

Closing an E3 does not mean that the result disappears.

It means the temporary encrypted execution surface is no longer active.

The E3 does not persist as a shared database or reusable enclave. Its committee does not retain an ongoing position from which it can return to the computation and decrypt its underlying inputs.

Shared secret state is ephemeral. Shared results persist.

How E3s Fit Into the Interfold

An E3 is the core execution unit of the Interfold, but it is not the network itself.

Each part has a distinct role:

• The Interfold coordinates the network and protocol.
• Ciphernodes perform computation-specific threshold duties.
• E3 programs define how encrypted inputs are processed.
• Compute providers execute the encrypted computation.
• E3s coordinate these roles within a temporary environment for one computation.
• Applications allow participants to request E3s, submit inputs, and use their results.

Together, these layers allow independent parties to produce shared, verifiable outcomes without placing plaintext data or decryption control inside a persistent environment governed by one operator.

Each E3 exists for one computation.

The Interfold makes that computation possible across a distributed network.

Participate in the Interfold network
A distributed network for confidential coordination.