SGX is Intel's TEE (Trusted Execution Environment) platform, where an isolated memory address space (aka enclave) can host applications which give certain guara

SGX is Intel's TEE (Trusted Execution Environment) platform, where an isolated memory address space (aka enclave) can host applications which give certain guarantees: * No outside code can gain access to any part of it - not even the host OS * Applications run precisely as executed (binaries need to be chryptographically signed) You could generate cryptographic keys inside the enclave and ensure that the private key is never seen in cleartext outside it. Let's say you're building a SaaS product to host sensitive data and expose an API. Using SGX, the remote endpoint can be ensured of the above. Root keys are signed by Intel (and recently delegated to cloud providers) - so there is some element of trust there. This attack uses power management interfaces to the hardware to induce faults in computations in the enclave, leading to data leaks. In the example above, the machine operator (or someone who gained privileged access on their machine) could abuse this to get access to sensitive data that's supposedly only inside the enclave. In any case and even in the absence of these threat vectors, SGX and similar solutions should be used as a layered security approach, not something to rely solely upon.