It's time to talk about TEEs - Alin Tomescu

Alin Tomescu argues that developers should reconsider deploying TEE-based applications, and should not put valuable secrets in TEEs, because the hardware's security claims are shaky. He surveys attacks including Foreshadow (2018), which let a malicious OS steal an Intel SGX attestation key, and several 2025 physical interposition attacks on DDR4 and DDR5 systems. He also notes that Intel TDX attestation is only safe if a verifier is pinned to the verifier's own PCK certificates, and that a 2024 BadRAM attack let a tampered DIMM produce false attestations on AMD SEV-SNP systems.