Transport

This is a working draft of VEIL and not a standards-track document. It describes request encryption, the relay and lane selection as designed for Verify Route. None of it is deployed yet; when a part ships, this section will say which, and the changelog will record it.

Attested requests are encrypted end to end to the enclave with HPKE, so the router forwards ciphertext. Blind-lane requests also pass an oblivious HTTP relay run by a party independent of the router.

The words MUST, MUST NOT, SHOULD, SHOULD NOT and MAY are used as in RFC 2119 and RFC 8174 when written in capitals. Terms used across the documents:

• Router: the Verify Route service that routes, prices and signs calls.
• Enclave: a confidential VM, optionally with a confidential GPU, running the sidecar and a model server.
• Sidecar: the process in the enclave that measures weights, holds keys and signs node receipts.
• Quote: hardware-signed evidence of what was measured into the enclave.
• Lane: the privacy floor of a request, one of standard, attested or blind.

The client fetches the enclave's HPKE public key from its verified evidence and seals the request body with HPKE (RFC 9180, DHKEM(X25519), HKDF-SHA256, AES-128-GCM). The outer request keeps only what routing needs: model, lane and an upper bound on size.

The enclave answers with a framed response sealed to a key derived from the same HPKE context, so the router cannot read the answer either.

On the blind lane the client sends an Oblivious HTTP message (RFC 9458) to a relay. The relay forwards it to the router's gateway without the client's address; the gateway cannot see who sent it, and the relay cannot read it. The relay operator MUST be independent of the router operator for the property to hold.

A lane is set by the X-VR-Lane header, a model suffix, or the key's default, and the strictest of them applies. The router MUST refuse a request it cannot serve at the requested lane with one of:

• no_attested_endpoint: no host has a fresh quote for this model.
• lane_requires_blind_payment: a key or wallet was presented on the blind lane.

• Message size and timing can link blind-lane requests; clients SHOULD pad and MAY add delay.
• A relay and router run by the same party provide no network separation.