Everybody is talking about Confidential Computing - the minimum Devs should know
summary
Argues that hardware-based TEEs (not FHE or SMPC) are the practical path now, using Intel TDX and AMD SEV-SNP to encrypt memory and provide remote attestation; describes attestation flow (firmware or in-guest agent → attestation server), host proxy using vsock for network, and vTPM/SVSM (coconut) to unlock disks and persist state. Notes Linux kernel patches partly merged (AMD landed, Intel pending), Kata confidential containers work in progress, and FHE remains 100–1,000× slower.
AI-written summary · about
chapters (10)
- 0:00Confidential computing intro
- 1:07Why it matters today
- 3:21What it actually means
- 8:04Trusted execution environments
- 12:20Intel TDX and AMD SEV-SNP deep dive
- 13:25Untrusted environments and roots of trust
- 16:17How attestation works
- 20:56TPM vs confidential VMs
- 26:19Open source projects
- 31:39Q&A
related talks
37mIt's All About Trust: Why Confidential Computing Matters
42mSponsored Session: Confidential Computing - New Capabilities for New Workloads
44mAdvancements in Confidential Computing- 37mIt's All About Trust: Why Confidential Computing Matters
11mLightning Talk: Computing Confidentially in the Clouds
47mThe Rise of Confidential Computing, What It Is and What it Means to You
41mPanel: A New Root Of Trust: Changing Computing With TEE
23mDemystifying Confidential Computing: An update for enthusiasts & professionals