PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Enhancing trust for SGX enclaves

blog.trailofbits.com | blog | #supply-chain | #confidential-computing | #tee | #sgx | #reproducible-builds | #nix
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits used Nix to make SGX enclave builds reproducible, letting users audit whether an enclave runs its claimed source; they packaged the SGX SDK in Nixpkgs and released reproducible-sgx.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Vulnerabilities in LUKS2 disk encryption for confidential VMs
New LUKS2 flaws (CVE-2025-59054, CVE-2025-58356) affect eight confidential VM systems: malleable headers let disk-level attackers trick TEE guests into encrypting secrets with a null cipher.
blog · blog.trailofbits.com
Announcing our first virtual Empire Hacking
Trail of Bits' biweekly Empire Hacking meetup went virtual on April 14, 2020, featuring talks on Red Hat's Enarx TEE project and automated vulnerability patching under DARPA CHESS.
blog · bughunters.google.com
Strengthening the Foundation: A Joint Security Review of Intel TDX 1.5
Google and Intel jointly reviewed Intel Trust Domain Extensions (TDX) 1.5, and this post details the findings of that security review for confidential computing.
blog · jfrog.com
Native Nix Support in Artifactory: The Binary Cache for the Enterprise
JFrog adds native Nix repository support to Artifactory, positioning it as the enterprise binary cache: proxied public caches, securely hosted proprietary packages and reproducible builds.
blog · blog.trailofbits.com
Package managers have an integrity problem
# Package managers have an integrity problem Keegan Ryan October 14, 2026 supply-chain, cryptography, ecosystem-security Page content * Simulating malicious package repositories * HTTPS is...
blog · blog.trailofbits.com
Don't let TEEs break your MPC
Combining threshold signatures with trusted execution environments (TEEs) can strengthen MPC deployments, if the TEE serves as a defense-in-depth layer rather than a substitute for a sound protocol.
Back