Solving the hardware problems around this makes all sorts of things possible, not just one-time programs. What's needed? Some sort of secure element, and some

Solving the hardware problems around this makes all sorts of things possible, not just one-time programs. What's needed? Some sort of secure element, and something like an HSM or, probably better, a TPM (2.0). Why is a TPM better? Because it has a very powerful authorization system that can be used to implement things like one-time operations among many other things. AWS Nitro has a clever secure element scheme -- something that can work for clouds, which might be good enough. Their NitroTPMs do not come with Endorsement Key (EK) certificates (EKcert), and there's no AWS VM<->EKpub lookup service either (unlike in Google's cloud, where there are no EKcerts but they provide an equivalent EKpub lookup service). So using NitroTPM right now is hard: how do you decide to trust the enclave in which the one-time program is to run? Being able to run secure enclaves on user devices would be great for some things, but, of course, the user loses a lot of control. Being able to run on a cloud enclave that is accessed by the user might be good enough in some cases, but now you need a strong binding of user to cloud enclave so that you can ensure that the program runs only once. On the plus side to running in a cloud enclave: there's less hardware to create if you trust the cloud operator.