Lesson 7.2 · 15 min read

NVIDIA H100 confidential computing

On-die root of trust, CC modes, encrypted transfers over PCIe, and GPU attestation.

How the GPU joins the TEE

NVIDIA describes the H100 as the first NVIDIA GPU to support confidential computing. Its TEE is anchored in an on-die hardware root of trust with measured and attested boot. When confidential computing mode is enabled, GPU firmware configures hardware firewalls to block unauthorised access to the protected workload, and performance counters are disabled to reduce side-channel exposure.

Data, command buffers and CUDA kernels crossing PCIe are encrypted by the driver in the CVM and decrypted by the GPU, using encrypted bounce buffers in shared memory.

H100 confidential computing modes, as described by NVIDIA
Mode	Meaning
CC-Off	Standard operation, no confidential computing protections
CC-On	Full confidential computing: firewalls active, performance counters disabled, encrypted CPU-GPU transfers
CC-DevTools	Matches CC-On workflows for development, but with security protections disabled and performance counters enabled. Not for production data.

Performance notes

NVIDIA states that raw GPU compute and HBM bandwidth are at parity with non-confidential mode, while CPU-GPU transfer bandwidth is limited by the CPU's encryption performance because data is staged through encrypted bounce buffers. Workloads that move large volumes across PCIe are affected most. NVIDIA also notes that on-package HBM is not encrypted; it is considered secure against everyday physical attack tools.

Key takeaways

H100 confidential computing is rooted in an on-die hardware root of trust with measured, attested boot.
CPU-GPU traffic is encrypted via bounce buffers; HBM is protected by firewalls and is not encrypted.
CC-DevTools disables protections: treat it like debug mode.

Sources: NVIDIA: Confidential Computing on H100 GPUs, NVIDIA confidential computing documentation.