0x0a / 0x0eHow do I compute on someone else's machine without trusting them?
Confidential Computing
Trusted execution environments such as Intel TDX, AMD SEV-SNP, Arm CCA and NVIDIA GPU TEEs, remote attestation, and the side channels that keep breaking them.
Start here
Guides
Technologies
Apple Secure Enclave (SEP)
Deep dive
✓ Battle-tested
Confidential Containers (CoCo)
Deep dive
Usable
Gramine
Deep dive
Usable
IBM Secure Execution (LinuxONE / Z)
Deep dive
Usable
Marlin Oysteralso in compute
Deep dive
Usable
NVIDIA GPU TEEs
Deep dive
Usable
Phala and 0Galso in compute
Deep dive
Usable
TEE Technologies: SGX, TDX, SEV-SNP and Friends
Deep dive
Usable
Arm Confidential Compute Architecture (CCA)
Deep dive
Experimental
Open-Source TEEs
Deep dive
Experimental
Reference and research
Compare decentralized compute platformsalso in compute
Comparison
Usable
Compare fully homomorphic encryption libraries
Comparison
Usable
Confidential Computing Across Cloud Providers
Comparison
Usable
Confidential Data Vending Machines
Research note
Research
Private computation comparedalso in cryptography
Comparison
TEE Side-Channel Attacks
Threat model
! Cautionary
Directory86 curated links
GPU Confidential Computing
- Stealth Cloud Confidential Computing Deep Dive — Technical overview of Intel TDX, AMD SEV-SNP, ARM CCA, attestation protocols, and hardware root of trust
- Benchmarking Confidential Computing: TDX v/s SEV-SNP — 2025 IEEE HPCC paper comparing TDX and SEV-SNP performance on Azure
- Confidential Computing in VMware Cloud Foundation 9.0 — AMD SEV-SNP & Intel TDX workload isolation in VMware
Confidential computing on GPUs
- TEE.Fail Side-Channel Attack — Extracts secrets from Intel SGX/TDX and AMD SEV-SNP with Ciphertext Hiding (October 2025)
- Phala Confidential Computing Trends 2025 — Gartner predicts 60% of enterprises will evaluate TEE by year-end, GPU TEE for AI workloads matures (2025)
- continuum
- confidential AI from GPU enclaves
- Building GPU TEEs using CPU Secure Enclaves with GEVisor
- Evaluating DeepSeek in Confidential Computing — Analyzing TEE impact on LLM inference efficiency
- GPU Travelling for Confidential Collaborative Training — Using confidential GPUs for privacy-preserving ML training
- Red Hat: Enhancing AI inference security with confidential computing — Extending TEE boundary to GPUs
- GPU-TEE-Papers — Curated paper collection on CPU/GPU TEEs, NVIDIA H100 confidential computing, and GPU memory security
Confidential AI & Private Inference
- Tinfoil — Verifiably private AI inference platform using NVIDIA confidential computing GPUs and remote attestation
- tinfoilsh/coco-inferencing — Open-source confidential AI inference stack developed with Red Hat
- mithril-security/blindai — Confidential AI deployment framework for serving models inside secure enclaves
- intel/confidential-computing-zoo — Intel examples for confidential AI inference, SGX, TDX, HE, and remote attestation
- microsoft/onnx-server-openenclave — Open Enclave ONNX inference server with encryption and attestation support
- NVIDIA Confidential Computing TDX Deployment Guide — NVIDIA guide for deploying H100 confidential computing with Intel TDX
Confidential computing on CPUs
- confidential-containers/trustee — Attestation and secret-management components for Confidential Containers
- krunvm — CLI for creating microVMs with libkrun, including confidential virtualization workflows
- Trusted Container Extensions for Container-based Confidential Computing
- Trusted execution environment
- Confidential Containers
- Firecracker-microvm
- Confidential computing
- Kata containers
- awesome-zama
- zama.ai
- Remote attestation Procedures Architecture
- Trusted Execution Environment Provisioning (TEEP) Architecture
- CoCo attestation proposal KBS / AS
- Generic Key Broker System for CoCo
- Constellation - Always encrypted kubernetes
- Garmine Shielded Containers
- Confidential containers in kubernetes
- Garmine library OS - run applications in enclaves
- COCONUT Secure VM Service Module
- enclavie
- List of SGX supported Intel CPUs
- List of SGX hardware
- Secure Multi-Party Computation Without Agreement
- SGX Secure Enclaves in Practice: Security and Crypto Review
- General overview of AMD SEV-SNP and Intel TDX
- Occlum
- awesome-confidential-computing
- Fraunhofer-AISEC/cmc — Remote attestation for Trusted and Confidential Computing platforms (TPM, AMD SEV-SNP, Intel SGX/TDX)
- inclavare-containers/TNG — Trusted Network Gateway: A tool for establishing secure communication tunnels in confidential computing
- Phala-Network/phala-cloud — Confidential Computing native cloud platform
- ultravioletrs/cocos — Cocos AI - Confidential Computing System for AI
- NVIDIA/nvtrust — Ancillary open source software to support confidential computing on NVIDIA GPUs
- flashbots/flashbots-images — Reproducible hardened Linux images for confidential computing and safe MEV
- edgelesssys/marblerun — Control plane for confidential computing: deploy, scale, and verify confidential microservices on vanilla Kubernetes
- ccc-spdm-tools/spdm-rs — Rust implementation of the DMTF SPDM protocol for Confidential Computing device attestation
- ccc-certifier-framework/certifier-framework-for-confidential-computing — Multi-vendor confidential computing certifier framework with policy-driven trust management
- automata-network/amd-sev-snp-attestation-sdk — AMD SEV-SNP attestation SDK: generate attestation reports and ZK proofs verifiable on-chain
- automata-network/tdx-attestation-sdk — Intel TDX attestation SDK: generate TDX quotes and ZK proofs verifiable on-chain
- gramineproject/gramine-tdx — Gramine library OS with experimental Intel TDX support for multi-process applications
- riscv/riscv-smmtt — RISC-V privilege ISA extensions for Supervisor Domain isolation (confidential computing, fault isolation)
- google/cc-device-plugin — Kubernetes device plugin exposing Confidential Computing devices in GKE clusters
- IntelLabs/tdx-workload-attestation — Library for attesting VM workloads inside Intel TDX environments
- Keystone Enclave — Open-source TEE framework for RISC-V processors with customizable secure enclaves
- intel/confidential-computing.tee.dcap.qvl — Intel TEE DCAP Quote Verification Library for ECDSA-based attestation
- Intel TDX on IBM Cloud Frankfurt — Intel TDX now available on IBM Cloud in Frankfurt (October 2025)
- Google Cloud Confidential Computing TDX — GKE nodes, Confidential Space, and GPU support for TDX
- Intel SGX/TDX URL Migration (Nov 2025) — SGX repositories moving to intel/confidential-computing prefix
Oblivious RAM & Encrypted Storage
- Oblivious Labs — Open source ORAM implementations used by Signal for private contact discovery
- obliviouslabs/oram — Oblivious key-value store based on Circuit ORAM
- obliviouslabs/benchmarks — ORAM benchmarks comparing Signal and Meta implementations
- mobilecoinfoundation/mc-oblivious — ORAM libraries for secure enclave applications
- facebook/oram — Oblivious RAM implementation for secure enclave applications
- Signal faster ORAM layer — Technical deep dive on Path ORAM for private contact discovery inside enclaves
- Signal Contact Discovery Service — Private contact discovery microservice that hides users' contact graphs from the server
Azure
- Onidel Cloud AMD SEV-SNP vs Intel TDX — 2025 comparison guide for VPS isolation and performance
- Azure confidential enclave nodes on AKS — CLI guide for deploying confidential enclave nodes on AKS
- Gramine AKS attestation example — Example for running Gramine workloads with Azure Kubernetes attestation
- Azure confidential containers enclaves — Azure documentation for confidential containers with enclave-aware providers
AWS
Alibaba
Library Operating Systems
- Gramine — Library OS for applications using Intel SGX
Homomorphic encryption libraries
- OpenFHE — C++ library with integer, approximate and Boolean homomorphic encryption schemes
- TFHE-rs — Rust TFHE implementation with programmable bootstrapping
- Microsoft SEAL — C++ homomorphic encryption library implementing BFV, BGV and CKKS
- Lattigo — Go homomorphic encryption library with CKKS bootstrapping and multiparty protocols
- HElib — Homomorphic encryption library implementing BGV with bootstrapping and CKKS