Nautilus & Enclaves on Sui — Moving Keys Out of Hot Wallets, Not Trust

​ About This Event

Every Sui app that signs on behalf of users lives one leak away from disaster. Trusted Execution Environments (TEEs) fix this, and Nautilus brings them to Sui. Whether you're building custody flows, delegation systems, or any dApp that handles sensitive keys, this session gives you a practical grounding in how enclaves actually work and why they belong in your stack. You'll leave knowing exactly what TEEs guarantee (and what they don't), with a Nautilus enclave running on your own laptop, and with a clear picture of how production Sui apps like Sona structure their trust boundary end-to-end.

What You'll Learn

- What a Trusted Execution Environment (TEE) actually guarantees — and what it doesn't
- How AWS Nitro Enclaves work under the hood: vsock-only I/O, no disk, no network, and what that forces in your design
- PCR measurements and attestation documents — the signing chain from AWS root to your enclave
- Envelope encryption with Seal — why the enclave is the only thing that ever sees plaintext keys
- How to run a Nautilus enclave locally and hit

​/keygen

​,

​/sign

​, and

​/health_check

​ from your own code
- How to verify enclave attestations on-chain inside a Move module (walking through Sona's real seal_policy.move)

Who Should Attend

- Developers building on Sui who handle user keys, custody, or sensitive data
- Backend and infra engineers working on signing services or delegation systems
- Security-conscious Web3 devs building with Seal, Walrus, or custom access policies
- Builders who want to see how production Sui apps structure their trust boundary

What to Bring

- Your laptop
- Docker installed (for running Nautilus in dev mode)
- Basic familiarity with TypeScript and the terminal
- Interest in building secure, production-grade apps on Sui

Join us at SuiHub to learn, build, and connect with fellow developers pushing the boundaries of the Sui ecosystem.