TEEs

[pando85]

We have to analyze if it's possible to secure our process with TEEs (Trusted Execution Environments). We can use https://enarx.dev/

The goal is to have the same user experience but improving a bit the security.

[pando85]

@forkline analyze all the possibles solution and make a recommendation for achieve our goal.

[forkline-bot]

Summary

I've completed a comprehensive TEE analysis for issue #168 and created PR #169: #169

Key Findings

Solution	Feasibility	Status	Reason
Gramine	HIGH	Active (June 2025)	Runs unmodified binaries, Intel SGX support
Occlum	MEDIUM	Active (March 2025)	Rust LibOS, requires more integration
Enarx	LOW	No releases since 2023	Requires WebAssembly, uncertain future
Confidential Containers	LOW	Active	Kubernetes-focused, overkill for single-node
Intel SGX SDK	LOW	Mature	Requires significant code refactoring

Recommendation

Primary: Gramine with Intel SGX

• Production-ready with active development
• Runs unmodified Rust binaries
• Minimal user experience impact
• Strong backing (Intel, Golem, ITL)

Keep TPM 2.0 Backend

• Hardware binding without requiring TEE hardware
• Works on any Linux system

Implementation Path

1. Create Gramine manifest for Passless
2. Add SGX-sealed storage backend (optional)
3. Document Intel SGX hardware requirements
4. Keep existing backends as primary options

Files Changed

• docs/TEE_ANALYSIS.md - 446 lines of comprehensive analysis