Skip to main content

​
Quick Decision

Both Cloud KMS and Onchain KMS offer highly secured code authentication and key management. The only difference is governance:
  • Cloud KMS: Phala manages authorization policies (faster, simpler)
  • Onchain KMS: Blockchain smart contracts control authorization (distributed trust, provable enforcement)
Choose Cloud KMS for quick deployment. Choose Onchain KMS when you need distributed governance that no single entity controls.

​
Why This Matters

With Onchain KMS, authorization policies are enforced by blockchain consensus, not a single company. In Cloud KMS, Phala controls what code runs. If Phala’s systems are compromised or pressured, policies can change. With Onchain KMS, governance rules are enforced by the blockchain network—thousands of nodes must agree to execute the smart contract logic. No single entity can override these rules. This distributed enforcement matters for high-stakes applications. Even if the developer accounts are compromised, attackers can’t deploy malicious code without satisfying your onchain governance requirements (like multi-sig approval or timelock delays). The blockchain network enforces your rules, not a centralized service.

​
Cloud KMS

Cloud KMS uses centralized governance managed by Phala Cloud. You deploy your application, and Phala handles all KMS infrastructure and authorization. This works well when you want fast deployment and trust Phala to manage governance policies.

​
How it works

Deploy to Phala Cloud and your application automatically gets keys from Cloud KMS after attestation. No blockchain setup needed.

​
Trade-offs

Simple and fast. Phala controls authorization policies and can update them. This means users trust both you (the developer) and Phala’s operational security.

​
Onchain KMS

Onchain KMS uses blockchain smart contracts to control what code can run under your application identity. Governance is enforced by distributed consensus, not a single party. This works well for privacy-focused or high-value applications where you need provable governance that survives compromise of any single entity. You can implement collective decision-making through multi-sig, DAO, or timelock contracts.

​
How it works

Deploy your DstackApp contract via the web UI:
  1. Go to Phala Cloud dashboard
  2. Choose “Onchain KMS” when creating your app
  3. Select Ethereum or Base
  4. Click deploy
Advanced: You can also deploy DstackApp contracts via CLI or deploy your own custom contracts that follow the interface. See the dstack repository for details.

​
Governance controls

The DstackApp contract has an owner role that controls what code can run. By default it’s your wallet address, but you can set it to any contract. Set the owner to a timelock contract for a 7-day delay on code updates. Or use a multi-sig wallet to require 3-of-5 signatures for changes. Or point it to your DAO contract for token holder voting. This enables collective decision-making instead of single-admin control. Even if one key is compromised, governance rules still require the full multi-sig or timelock delay.

​
What governance controls

Governance controls your application identity: what code is allowed to run and access your application’s keys. This includes initial deployment, code updates, and who can approve changes. The difference from Cloud KMS: blockchain nodes enforce these rules through consensus. You can’t bypass them by compromising a server or pressuring a company. The blockchain network validates every authorization check.

​
Authorization flow

When your CVM requests keys, KMS verifies your TEE attestation quote, then queries your DstackApp contract on Ethereum or Base. The contract checks if this code hash is approved. If yes, keys are provisioned. This query is validated by blockchain consensus. The result is cryptographically verifiable and can’t be tampered with by any single party.

​
Trade-offs

You get distributed enforcement and collective decision-making. Setup requires deploying a contract, though Phala’s UI makes this simple.

​
Ethereum vs Base

Phala Cloud supports Onchain KMS on both Ethereum and Base. Ethereum has higher gas costs but maximum decentralization. Base is an L2 with lower gas costs and fast finality.

​
Security

Both use identical dstack-kms security for TEE operations: attestation-based key provisioning, key rotation, forward/backward secrecy. The difference is governance enforcement:
  • Cloud KMS: Centralized policy enforcement by Phala
  • Onchain KMS: Distributed policy enforcement by blockchain consensus
With Onchain KMS, compromise of any single entity (your keys, Phala’s systems, or individual blockchain nodes) doesn’t compromise governance. The blockchain network collectively enforces your rules. See What is KMS for detailed security model.