The Machine Lies to Its Own Owner
The Machine Lies to Its Own Owner
Ordinary computer security assumes the operating system is trustworthy: it is the referee, the landlord, the one thing every program must go through. Confidential computing breaks that assumption on purpose. ARM TrustZone splits a single processor into two worlds, Secure and Normal, with a hardware bit on every bus transaction deciding which side a given instruction belongs to — so a compromised or even malicious operating system in the Normal world simply cannot see into the Secure one, no matter what privileges it holds.
Intel SGX and AMD SEV push this further: they assume the operating system, the hypervisor, and even the cloud provider renting you the machine might be adversaries, and encrypt guest memory in DRAM itself, transparently, at the memory controller. The chip keeps a cryptographic integrity tree over that encrypted memory so that even a physical attacker with a logic probe on the DRAM bus cannot read or tamper with it undetected. The hardware, in effect, promises the tenant more privacy than the owner of the machine is structurally able to violate — a landlord who cannot pick his own locks.
A TPM anchors all of this in something that predates the running system entirely: measured boot chains hashed into Platform Configuration Registers before the operating system loads a single instruction, so a remote party can cryptographically verify what code actually ran, not merely trust what the machine claims.
Seed: Hardware Security Enclaves & Cryptographic Accelerators (ARM TrustZone, AMD SEV, Intel SGX, TPM 2.0). Central fact: these systems build isolation and trust roots at a layer beneath the operating system itself, so that even the OS or hypervisor — normally the most privileged, most trusted software on the machine — is treated as untrusted and structurally unable to read or tamper with protected memory.