Operator-Blind Secret Mediation for AI Agents: A Formal Model and FHE Construction for Credential Derivation on Untrusted Infrastructure
TL;DR
This work formalizes the model and proves computational operator blindness from indistinguishability under chosen-plaintext attack (IND-CPA) security of the FHE scheme, together with conditional capability binding for any secure pseudorandom function/message authentication code (PRF/MAC) instantiation.
Abstract
Artificial intelligence (AI) agents increasingly need credentials such as application programming interface (API) keys and Secure Shell (SSH) credentials, but placing those secrets in the agent process exposes them to prompt injection, tool misuse, and exfiltration through ordinary agent outputs. We present CapSeal, a capability-based broker that replaces direct secret access with session-bound, non-exportable handles. Agents request policy-evaluated actions, while the broker performs credential-bearing Hypertext Transfer Protocol (HTTP) and SSH execution through typed executors with schema validation, replay protection, revocation epochs, and tamper-evident audit logging. We extend this design to hosted settings where the broker operator is not trusted with tenant secrets. Our main contribution is operator-blind secret mediation: a split-broker architecture in which a small trusted tenant gateway cooperates with an untrusted operator service that stores the master secret only as a fully homomorphic encryption (FHE) ciphertext and evaluates per-request derivations without decrypting it. We formalize the model and prove computational operator blindness from indistinguishability under chosen-plaintext attack (IND-CPA) security of the FHE scheme, together with conditional capability binding for any secure pseudorandom function/message authentication code (PRF/MAC) instantiation. We implement an end-to-end TFHE-rs prototype that exercises split-broker derivation, multi-tenant revocation and rate limiting, audit integration, and HTTP/SSH mediation. The prototype uses a non-cryptographic homomorphic stand-in and measures the cost of crossing the operator-untrusted boundary at about 9 s per request, roughly 17 million times slower than the plaintext path. We also give LowMC and Rasta transciphering designs and compare FHE with trusted execution environment (TEE)- and secure multiparty computation (MPC)-based alternatives, positioning each trust boundary by assurance and performance.