securitytpmsgx

What is the difference between trusted computing and confidential computing?


It seems that both trusted computing and confidential computing can protect data in use.
Is trusted computing based on TPM and confidential computing based on Intel SGX?
Any other difference?


Solution

  • This is a good question since both terms are a bit ambiguous used interchangeably. The short answer is they mean the same in most cases.

    Trusted Computing was probably the term that appeared first. It tries to put the emphasis on the reduced "trusted parties/components", called the Trusted Computing Base (TCB), that modern processor technologies as Intel SGX, AMD SEV, ARM TrustZone provide. They all have in common that code and data are separated and protected at all times during execution in so-called Trusted Execution Environments (TEE). Trusted Computing doesn't necessarily need to be backed by hardware features, it could also be provided by Hypervisor technologies as Hyper-V VBS or AWS Nitro Enclaves. Naturally, the TCB is bigger on such Hypervisor TEEs.

    Is trusted computing based on TPM and confidential computing based on Intel SGX?

    No, SGX is probably the most prominent example of trusted computing technology. TPMs of course can also be used to establish a root-of-trust, but they typically not able to create complete TEEs for protecting data at runtime. They are more commonly used for secure/trusted key generation and storage, or crypto calculations. To be precise a TPM is physically isolated while a TEE resides on the same chip. See also TPM vs. TEE vs. SE

    Confidential Computing is a relatively new term. It was probably established to have a bit more business-friendly term. "Trusted" might be harder to sell than "Confidential";-) The term puts more emphasis on the application of TEEs and tries to address a wider audience by describing not only the technologies but the applications and business cases in general. In the words of the Confidential Computing Consortium

    Confidential Computing is the protection of data in use using hardware-based Trusted Execution Environments. Through the use of Confidential Computing, we are now able to provide protections against many of the threats described in the previous section.

    With both terms floating around. "Confidential Computing" got much more traction and mainstream adoption, while Trusted Computing feals more niche. Trusted Computing will probably disappear as a general term and only be used when describing hardware features and TEEs in more technical detail.