Intel Trust Domain Extensions
summary
Intel TDX adds a TDX module running in SEAM mode that builds hardware-isolated VMs called trust domains (TVs) using secure page tables and multi-key memory encryption tied to 64-byte cache lines. It trades a larger TCB for easier porting versus SGX, supports 28-bit SHA3 MAC integrity mode as an option, and ships on Sapphire Rapids with broader availability planned on Emerald Rapids. Roadmap items include TD partitioning, attested TD migration, TD-preserving module updates, and PCIe/SPDM-based device attachment (TDX Connect).
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:49Intel Trusted Execution Environments
- 6:55Confidential Computing Motivations
- 8:25Intel TDX Architecture
- 13:12Memory Encryption & Integrity
- 17:33Intel TDX Availability with 4th Gen Intel Xeon Scalable
- 18:16Next Generation Feature - TD Partitioning
- 21:43Next Generation Features - TD Migration
- 24:29Next Generation Feature - TD Preserving Updates
- 27:23Introducing Intel® TDX Connect
related talks
27mIntel Trusted Domain Extensions (TDX) Host Kernel Support
23mAllowing an Intel TDX Module to Run Without SEAM
41mPanel: A New Root Of Trust: Changing Computing With TEE
41mIntroducing IO Devices into Trusted Execution Environments
20mIntel Virtualization Technology Extensions to Enable Hardware Isolated VMs
28mSecure bootloader for Confidential Computing
25mExploring I/O Support for Virtualization-Based Trusted Execution Environment
37mIt's All About Trust: Why Confidential Computing Matters