Eclypses
MTE vs TLS

Managed Key Encryption

One key per message.
Expose one. The rest hold.

MTE mints a single use key for every message it protects. An exposed key opens that one message and nothing else.

1key per message 0keys cross the wire FIPS140-3 certified core

Every message picks up its own key on the way out.TLS still wraps the connection. MTE wraps the message.

The blast radius

Expose one key.
Count what is at risk.

Eight messages in flight. TLS covers them with one session key. MTE gives each message its own.

Or pick any MTE message to choose which key leaks.

TLS aloneOne session key protects every message until it rotates
Session key
1
2
3
4
5
6
7
8
0of 8 at riskno key exposed
MTEA fresh key for every message
Key per message
0of 8 at riskno key exposed

Both layers are holding. Flip the switch to expose one key and watch how far it reaches.

Illustration: eight messages sent before TLS rotates its session key, each MTE message encrypted with its own key. One data key is exposed. Devices and key generation stay secure.

Why it holds

Fast, closed, layered.

Speed

Keys at line rate.

The next key is produced while the next message is protected. No handshake, no round trip, no key server in the path.

Security

Nothing to intercept.

Both ends generate the same key from a shared state that is never transmitted. Only encrypted messages travel.

Robustness

Layered, not swapped.

Keep TLS for the connection. Add MTE for the message. If the outer layer fails, the message is still encrypted.

FIPS 140‑3

Certified cryptographic core

Written in C

Built for speed, with SDKs for C#, Java, Swift, Objective C, JavaScript, Go, and Python

Single use

Every key is generated for one encryption event and never reused

Near original size

MKE payloads stay close to the size of the data they protect

Protect each message.
Contain the consequences.

MTE adds a fresh key to every exchange your application makes, on top of the TLS you already run.

Explore MTE technology Read the concepts guide
How the comparison works
  • MTE terminology. The comparison uses Managed Key Encryption (MKE), the mode of Micro Token Exchange (MTE) that generates a new single use key for each encryption event and encrypts with industry standard algorithms. The illustration assumes one encryption operation per message. Eclypses MTE concepts.
  • Where keys come from. Paired MTE encoders and decoders start from the same initialization values and advance their state together. Entropy is agreed with a key exchange and never sent over the network, so no message key ever crosses the wire. Eclypses MTE concepts.
  • TLS key scope. TLS 1.3 uses separate traffic keys for each direction, a fresh nonce for every record, and supports key updates. One exposed traffic key affects the records protected with that key, given the nonce and record data. It does not by itself expose the whole session, and reusing a key with unique nonces is standard design, not a flaw. Record protection and key updates in RFC 8446.
  • What the illustration shows. The reach of a single disclosed data key, assuming the other keys and the MTE generator state stay secret and the algorithms stay sound. It compares key reuse. It is not a guarantee against a compromised device, an exposed generator state, or a break of the underlying cipher. Protecting MTE state.
  • Where message protection ends. Payload protection lasts from the encoder to its paired decoder. An intermediary that only terminates TLS still sees an encoded payload. An intermediary that also decodes MTE can read the data. MTE Relay documentation.