Secure transfer and use of secret material in a shared environment

A system, comprising:

• at least one memory device having computer-readable instructions stored thereon;
• and
• at least one of one or more computing devices directed, through execution of the computer-readable instructions, to:
• receive double encrypted revocation data from a customer client device;
• extract vendor encrypted revocation data from the double encrypted revocation data by decrypting the double encrypted revocation data with a private provider key;
• extract revocation data from the vendor encrypted revocation data by decrypting the vendor encrypted revocation data with a private vendor key;
• receive an instruction from the customer client device to perform a cryptographic operation in a trusted execution environment using a secret key;
• and
• in response to the instruction, perform a revocation check to determine whether the secret key has been revoked.

A method, comprising:

• receiving, by at least one of one or more computing devices, double encrypted revocation data;
• extracting, by at least one of the one or more computing devices, vendor encrypted revocation data by decrypting the double encrypted revocation data with a private provider key;
• extracting, by at least one of the one or more computing devices, revocation data by decrypting the vendor encrypted revocation data with a private vendor key using a trusted execution environment;
• and
• in response to receipt of an instruction to perform a cryptographic operation using a secret key, performing, by at least one of the one or more computing devices, a revocation check to determine whether the secret key has been revoked.