WebAssembly in SGX

This is part of the TEEs for dummies series. Besides library OSes, another way to run unmodified programs in an SGX enclave is to put a WebAssembly runtime inside the enclave.

WebAssembly (Wasm) is a portable compilation target initially designed for web environments but later extended to standalone execution. Traditional applications can be written in a high-level language such as C/C++, Rust, or Go, and compiled into Wasm binaries for execution in constrained environments across multiple hardware platforms, such as x86, ARM, and RISC-V.

Academic projects like Twine integrate a Wasm runtime, e.g. WAMR, into an SGX enclave. This enables unmodified applications to execute in the enclave, similar to a LibOS.

The idea is the same as with Gramine or Occlum: you avoid manually partitioning the application with the SGX SDK. The application is compiled to Wasm, then the Wasm runtime (and the bytecode it executes) runs inside the enclave. The TCB now includes the Wasm runtime, which is typically smaller than a full library OS, at the cost of a different programming and deployment model.

This post is a short conceptual stop on the SGX track. Next we leave Intel process-level TEEs and look at Arm TrustZone.