Lesson 2.2 · 15 min read
Intel SGX and Intel TDX
Enclave measurements (MRENCLAVE, MRSIGNER), trust domains, the TDX module, and TD measurement registers.
Intel SGX
Intel Software Guard Extensions (SGX) lets an application create enclaves: protected regions of its address space. Enclave pages live in a processor-reserved memory region (the Enclave Page Cache) that is encrypted and integrity-protected; software outside the enclave, including the OS and hypervisor, cannot read it. The application enters the enclave through defined entry points (ECALLs) and the enclave calls out for OS services (OCALLs), which is exactly where untrusted input must be validated.
Two identity values matter in SGX attestation and policy:
| Field | What it identifies | Typical policy use |
|---|---|---|
MRENCLAVE | A hash of the enclave's initial code, data and layout as built | Pin one exact build |
MRSIGNER | A hash of the public key that signed the enclave | Trust any enclave from a given signer, combined with product ID and a minimum security version (ISVSVN) |
Modern SGX remote attestation uses ECDSA-based quotes (Intel SGX DCAP). Library operating systems such as Gramine let unmodified Linux applications run inside an enclave. Intel has removed SGX from recent client (desktop and laptop) processors; it remains a server feature on Intel Xeon platforms.
Intel TDX
Intel Trust Domain Extensions (TDX) protects whole VMs called trust domains (TDs). A CPU-measured Intel TDX module runs in a new CPU mode, Secure Arbitration Mode (SEAM), and acts as a peer to the host VMM, mediating TD entry and exit. TD memory is encrypted with per-TD keys using Intel Total Memory Encryption - Multi-Key (TME-MK), and the CPU state of the TD is protected for confidentiality and integrity.
| Register | Measures |
|---|---|
MRTD | The initial TD contents measured at build time, typically the virtual firmware (TDVF/OVMF) |
RTMR0-RTMR3 | Runtime measurement registers extended during boot, for example firmware configuration, the bootloader, kernel and command line |
REPORTDATA | 64 bytes chosen by the TD, commonly a hash of a public key or a verifier nonce |
Key takeaways
- SGX identity: MRENCLAVE pins a build; MRSIGNER plus product ID and security version trusts a signer's line of builds.
- TDX isolates VMs via the TDX module in SEAM mode; MRTD and RTMRs carry the measurements.
- REPORTDATA binds a key or nonce into the evidence; verifiers should require it.