The Room the Owner Cannot Enter
The Room the Owner Cannot Enter
Every layer of a computer's trust normally nests: the hardware trusts the firmware, the firmware trusts the kernel, the kernel trusts itself absolutely and grants or denies everyone else. A hardware enclave breaks that nesting on purpose. SGX carves out a region of memory — an enclave — that the CPU encrypts and access-controls beneath the operating system's own privilege level, so that code running as root, and even a compromised hypervisor beneath a virtual machine, cannot read the enclave's memory or single-step its execution. The machine's most privileged software becomes, with respect to this one region, an untrusted bystander.
TrustZone draws the same line differently: rather than carving holes inside one privilege ring, it duplicates the whole system into two worlds, Secure and Normal, switching between them like two computers sharing one die, with the Secure world's memory invisible from the Normal one no matter what runs there. Both approaches answer the same fear — that the operating system itself might be the attacker, or might be tricked into becoming one — by moving the boundary of trust out of software, which can always be patched or subverted, and into a fixed hardware guarantee that no software update can weaken.
The strange consequence: the owner of the machine, in the fullest technical sense, is no longer the most powerful actor on it. Root can see everything except the room it was never given a key to. This isn't a bug held over from an earlier design — it's the design's entire point, built for a world where "root" and "the party you don't trust" have quietly become the same thing.
Seed: Hardware Security Enclaves — ARM TrustZone & Intel SGX. Central fact: SGX and TrustZone create hardware-enforced isolated execution regions that the operating system kernel itself — even at its highest privilege level, even if compromised — cannot read or tamper with; trust is rooted in silicon rather than in whichever software claims the most privilege.