Intel SGX

SGX protects enclave memory through the Memory Encryption Engine (MEE) , a hardware unit integrated into the processor's memory controller. The MEE encrypts all data evicted from the CPU cache to DRAM and decrypts it upon retrieval, ensuring that even physical attackers with access to the memory bus cannot read plaintext enclave data. This cryptographic layer operates transparently to enclave software, providing confidentiality against cold-boot attacks and hardware probing without requiring application-level encryption logic.

The Enclave Page Cache (EPC) is a dedicated, encrypted region of DRAM reserved exclusively for enclave code and data. Key properties include:

• Hardware-enforced access control: Non-enclave software, including the OS kernel and hypervisor, cannot read or write EPC pages
• Page-level integrity: The processor maintains a cryptographic integrity tree (Merkle tree) over EPC contents to detect replay and splicing attacks
• Limited capacity: EPC size is typically 128-256 MB on consumer platforms, scaling to 512 GB+ on server-class Xeon processors with SGX2 and flexible launch control This physical isolation ensures that even a fully compromised operating system cannot extract enclave secrets.

Sealing allows an enclave to encrypt data for persistent storage outside the enclave while binding it to a specific enclave identity or sealing authority. Two sealing policies exist:

• MRENCLAVE-based sealing: Binds data to the exact enclave code hash, ensuring only the identical enclave binary can unseal it
• MRSIGNER-based sealing: Binds data to the enclave author's signing key, allowing versioned enclaves from the same developer to share sealed data Sealed data is encrypted with keys derived from the processor's Root Provisioning Key, which is fused into the hardware at manufacturing and never exposed to software. This enables stateful enclave applications that survive power cycles and process restarts.

SGX incorporates multiple defenses against microarchitectural side-channel attacks that attempt to infer enclave secrets through timing, cache, or power analysis:

• ASLR inside enclaves: Address Space Layout Randomization is applied to enclave memory layouts
• Transactional memory fencing: Intel Transactional Synchronization Extensions (TSX) can be used to suppress page-fault-based attacks
• Speculative execution barriers: LFENCE instructions and retpoline-style mitigations prevent Spectre-class attacks from leaking enclave data
• Constant-time cryptographic libraries: Intel's SGX SSL library implements timing-resistant algorithms to eliminate data-dependent execution paths Despite these protections, SGX's threat model explicitly excludes certain physical side-channels (e.g., power analysis with direct die access), and developers must follow secure coding guidelines to minimize leakage surfaces.