This is part of the TEEs for dummies series. RISC-V Physical Memory Protection (PMP) is not a full “enclave TEE” in the SGX/TDX sense, but it is the hardware primitive many RISC-V TEEs are built on...

This is part of the TEEs for dummies series. AMD Secure Encrypted Virtualization (SEV) is AMD’s counterpart to Intel TDX: a TEE for confidential virtual machines (CVMs). SEV uses AES to encrypt...

This is part of the TEEs for dummies series. Unlike SGX and TrustZone, which protect a single program at runtime, Intel Trusted Domain Extensions (TDX) protect an entire VM. In TDX, a protected...

This is part of the TEEs for dummies series. After TrustZone, which isolates a secure world from a normal world, Arm Confidential Compute Architecture (CCA) is Arm’s VM-level TEE. Arm CCA is an...

This is part of the TEEs for dummies series. Arm TrustZone is the main process-level TEE on Arm, and OP-TEE is the practical framework we will use to test it. Arm TrustZone (TZ) is a hardware secu...

This is part of the TEEs for dummies series. Besides library OSes, another way to run unmodified programs in an SGX enclave is to put a WebAssembly runtime inside the enclave. WebAssembly (Wasm...

This is part of the TEEs for dummies series. Similar to Gramine, Occlum is a library OS which allows you to run unmodified applications inside an SGX enclave. It is based on an academic paper from ...

This is part of the TEEs for dummies series. The previous post covered the Intel SGX SDK, which requires partitioning an application into trusted and untrusted parts. Gramine avoids that work. Gra...

This is part of the TEEs for dummies series. Here we set up Intel Software Guard Extensions (SGX) and run a first enclave with the Intel SGX SDK. Intel SGX is a TEE technology which enables app...

From my experience, it is often difficult to find practical and concise hands-on guides on how to use most TEE technologies. Official documentation is useful, but it usually contains far more infor...