> For the complete documentation index, see [llms.txt](https://cryptic-documentation.gitbook.io/cryptic-pq/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cryptic-documentation.gitbook.io/cryptic-pq/crytic-enterprise-whitepaper/2.-solution-architecture.md).

# 2. Solution Architecture

#### 2.1 High-Level Architecture

{% @mermaid/diagram content="graph TB
Client\[Client Application<br/>Web3 Protocol / Enterprise]

```
subgraph TEE["🔒 Trusted Execution Environment (Intel TDX)"]
    Gateway[API Gateway<br/>Authentication & Rate Limiting]
    
    subgraph Crypto["Cryptographic Core"]
        Dilithium[Dilithium3<br/>NIST ML-DSA-65<br/>Digital Signatures]
        Kyber[Kyber768<br/>NIST ML-KEM-768<br/>Key Encapsulation]
    end
    
    subgraph KeyMgmt["Key Management Modes"]
        Session[Session Mode<br/>RAM-only, ephemeral]
        Derived[Derived Mode<br/>Deterministic keys]
        TimeLimited[Time-Limited<br/>Auto-expire]
        HSM[CloudHSM Mode<br/>Phase 2]
    end
end

Storage[(SecretVM Encrypted Volume<br/>Platform + AES-256-GCM)]

Client -->|HTTPS + JWT/Signature| Gateway
Gateway --> Crypto
Crypto --> KeyMgmt
KeyMgmt -.->|Optional Persistence| Storage

style TEE fill:#e3f2fd,stroke:#1976d2,stroke-width:3px
style Crypto fill:#fff3e0,stroke:#f57c00,stroke-width:2px
style KeyMgmt fill:#f3e5f5,stroke:#7b1fa2,stroke-width:2px
style HSM fill:#ffebee,stroke:#c62828,stroke-dasharray: 5 5" %}
```

**Legend:**

* 🔒 Solid border = Production ready
* Dashed border = Phase 2 feature

#### 2.2 Technology Stack

| Layer        | Technology                     | Purpose                        |
| ------------ | ------------------------------ | ------------------------------ |
| **Hardware** | Intel TDX / AMD SEV-SNP        | Memory encryption, isolation   |
| **Platform** | Secret Network SecretVM        | TEE orchestration, attestation |
| **Runtime**  | Go 1.23                        | Service implementation         |
| **Crypto**   | NIST PQC Reference (C via CGO) | Dilithium3, Kyber768           |
| **API**      | RESTful JSON (Gin framework)   | Client interface               |
| **Auth**     | JWT / Chain signatures         | Multi-modal authentication     |
| **Storage**  | Encrypted filesystem           | Key persistence                |
| **Future**   | AWS CloudHSM (FIPS 140-2 L3)   | Hardware key isolation         |

#### 2.3 Deployment Platform: SecretVM

Cryptic deploys on Secret Network's SecretVM infrastructure:

**SecretVM Benefits:**

* **Automatic Attestation**: Remote attestation on port 29343
* **Encrypted Volume**: `/mnt/encrypted` managed by on-chain KMS
* **Docker-Based**: Standard containerization with TEE guarantees
* **Production Ready**: Used by multiple confidential computing applications