English
Menu

TrustZone vs SGX vs SEV/TDX: Isolation Unit, Trusted Computing Base and Memory Encryption Compared

All three are CPU hardware mechanisms, trusted execution environments (TEEs), that keep sensitive processing safe even if the normal OS or the hypervisor is compromised. They differ in the unit they carve out. TrustZone splits the processor into a secure world and a normal world and is used mainly in smartphones and embedded devices. SGX carves out only part of an application as an enclave, keeping the trusted computing base as small as possible. SEV and TDX encrypt the memory of an entire virtual machine (VM) so that even the cloud provider cannot read it, an approach known as confidential computing.

AspectTrustZoneSGX (enclave)SEV/TDX (VM-based confidential computing)
Isolation unitThe whole processor is split into a secure world and a normal world; a small trusted OS and trusted applications run in the secure worldA part of an application that handles secrets (the enclave)An entire virtual machine
Protects againstThe OS and applications in the normal world; even if that kernel is compromised, secure-world memory cannot be readThe OS, the hypervisor, other applications, and attackers who physically read main memoryThe hypervisor, the cloud provider's administrators, other VMs, and attackers who physically read main memory
Trusted computing base (TCB)The CPU hardware, the secure monitor that switches worlds, and the trusted OS and applications in the secure worldThe CPU hardware and firmware plus the enclave's own code; the OS is not includedThe CPU hardware and firmware (such as AMD's secure processor or Intel's TDX module) plus everything inside the VM, including the guest OS; the hypervisor is not included
Memory encryptionNot part of the basic mechanism; a bus signal marks accesses as secure or not, and the accesses themselves are blockedEnclave pages are kept encrypted in main memory outside the CPU; some implementations also detect tamperingThe entire VM memory is encrypted with a per-VM key managed only inside the CPU; SEV-SNP and TDX add integrity protection that stops the hypervisor from rewriting or remapping memory
AttestationNo common architectural scheme; built by combining the SoC's secure boot and key mechanismsThe enclave's launch measurement is signed with a key inside the CPU; users check the report before handing over secret dataThe CPU measures the VM's initial state and issues a report signed with a key inside the CPU; users check it before releasing the key that decrypts their data
Typical useBiometric matching, payment credentials, DRM key storage and verification during secure boot on smartphones and embedded devicesProtecting only part of a server workload, such as key management or processing of sensitive dataConfidential VMs in the cloud, running existing applications while protecting them even from the provider
Porting effortCode must be written as secure-world applications with a narrow interface to the normal worldLarge: the application is split into parts inside and outside the enclave, and system calls, file and network I/O are left to code outsideSmall: with a supported guest OS, existing operating systems and applications run almost unchanged
Known attack classesBecause cores, caches and power are shared, research has demonstrated cache side-channel attacks and fault injection through voltage or clock glitches; flaws in the trusted OS and applications are also targetedResearch has reported secrets leaking through side-channel attacks using cache timing, page-fault patterns and speculative executionResearch has reported attacks in which a malicious hypervisor manipulates the VM interface, such as memory mappings and interrupts, as well as side-channel attacks; integrity protection was added to counter such attacks
AvailabilityWidely used in Arm application processors, with a lightweight version in Armv8-M microcontrollers; Armv9-A also defines Arm CCA (Realms) for VM-level isolationAs of the early 2020s, Intel no longer offers SGX on client CPUs and provides it mainly on server CPUsSEV is a feature of AMD server CPUs and TDX of Intel server CPUs; as of the mid-2020s, major clouds offer them as confidential VMs

Figures are typical orders of magnitude and vary by process generation and product.

When to use which

TrustZone
On smartphones and embedded devices, when you want a secure area inside a single SoC without adding another chip. Biometrics, payments and secure boot checks run separated from the normal OS.
SGX (enclave)
On a server, when only a small, especially sensitive part of the work, such as key handling, must be isolated even from the OS and hypervisor. It gives the smallest trusted computing base but requires restructuring the application.
SEV/TDX (VM-based confidential computing)
In the cloud, when existing applications should run almost unchanged while being protected even from the provider's hypervisor and administrators. Remote attestation confirms the VM is the right one before data keys are released.

FAQ

Which is more secure, an enclave or a confidential VM?

They protect against similar parties but trust different amounts of code. An enclave removes even the OS from the trusted computing base, trusting only the CPU and the enclave's own code, so the TCB is the smallest. A confidential VM trusts the whole VM including the guest OS, so the TCB is larger, but existing software runs almost unchanged. The choice depends on how much code you need to protect and how much rework you can afford.

Does TrustZone encrypt memory?

The basic TrustZone mechanism is access control, not encryption. Every read or write the CPU puts on the bus carries a signal saying whether it is secure, and circuits in front of memory and peripherals reject normal-world accesses to secure regions. Some SoCs add encryption of external DRAM as a separate feature.

Does memory encryption also stop side-channel attacks?

No. Memory encryption prevents data in main memory from being read or modified, but cache usage, timing and page-fault patterns may still be observable from outside. Countermeasures are combined: code whose branches and memory accesses do not depend on secrets, microcode updates, and not sharing a core with untrusted parties.

Can SGX still be used?

As of the early 2020s, Intel no longer offers SGX on client CPUs and provides it mainly on server CPUs, so protecting applications on PCs can no longer assume SGX. On servers, VM-level schemes such as TDX are available alongside enclaves.

Check your understanding

Which describes a TEE (trusted execution environment)?

  1. AA hardware-protected execution environment isolated even from the normal OS, used for critical work such as key handling and authentication
  2. BAn environment for speeding up internet traffic
  3. CA text editor for writing programs
Show answer and explanation

Answer: A. A hardware-protected execution environment isolated even from the normal OS, used for critical work such as key handling and authentication

A normal OS is large and complex, so eliminating vulnerabilities completely is difficult. A TEE uses hardware mechanisms to create a small execution environment separated from the normal OS, where especially sensitive tasks run, such as fingerprint matching, payment processing and handling DRM keys. The goal is that even if the normal OS is compromised, the TEE's memory and keys remain out of reach. Arm TrustZone is a representative example.

What is the basic mechanism of Arm TrustZone?

  1. AAll secure processing runs on a separate PC
  2. BNormal-world programs can freely read secure-world memory
  3. CThe CPU has secure-world and normal-world states, and bus signals distinguish which world each memory or peripheral access comes from, enforcing restrictions
Show answer and explanation

Answer: C. The CPU has secure-world and normal-world states, and bus signals distinguish which world each memory or peripheral access comes from, enforcing restrictions

In TrustZone, a CPU core switches between secure and normal states, and every access carries a bus signal indicating which state issued it. Logic on the memory and peripheral side checks this signal and rejects normal-world accesses to regions assigned to the secure world. It creates a secure area within a single SoC without an extra chip, so it is widely used in smartphones and similar devices.

What characterizes enclave-style TEEs such as Intel SGX?

  1. AThe entire OS kernel runs from an external hard disk
  2. BPart of an application runs in a region whose memory the CPU encrypts and protects, so even the OS and hypervisor cannot read it
  3. CAnyone can freely modify data inside the enclave
Show answer and explanation

Answer: B. Part of an application runs in a region whose memory the CPU encrypts and protects, so even the OS and hypervisor cannot read it

In an enclave, only the part of an application handling secrets runs in a special memory region, which the CPU encrypts before it reaches main memory (some implementations also detect tampering). Neither the OS, the hypervisor nor an attacker physically reading memory can see its contents. Only the CPU and that code need be trusted. Vulnerabilities to side-channel attacks have also been reported, so careful use is needed.

  1. In confidential computing on the cloud, what is the purpose of CPU features that encrypt virtual machine memory (such as AMD SEV or Intel TDX)?
  2. Why do some systems handling confidential work disable the CPU's simultaneous multithreading (SMT)?
  3. Which describes remote attestation?

Practice Hardware Security questions

Key terms explained

TrustZone
Arm's processor security architecture, switching between secure and normal worlds and using bus signals to distinguish and restrict access to memory and peripherals.
Secure enclave
A TEE approach in which part of an application runs in a region whose memory the CPU encrypts and protects, hidden even from the OS and hypervisor.
Trusted execution environment (TEE)
A hardware-protected execution environment isolated even from the normal OS, used for critical work such as key handling and authentication, for example Arm TrustZone.
Hypervisor
Software that runs multiple virtual machines on one computer, allocating CPU, memory and devices to each guest OS and isolating them from one another. Also called a virtual machine monitor.
Remote attestation
A mechanism in which a device signs the state of its running software with an on-chip key and presents it to a remote server for trust verification.
Side-channel attack
An attack inferring secrets such as keys from physical information other than the intended output, such as processing time, power consumption or electromagnetic emissions.
Speculative execution
A CPU technique that executes instructions ahead based on predictions, such as branch outcomes, before they are known. Wrong results are discarded, but traces such as cache state may remain.

Related comparisons