mhtirogla
Home
Systems
API
Pricing
About
Log in
← Back
Home
›
Systems
›
Security and identity
confidential-compute
confidential computing enclaves
Nitro Enclaves, SGX
System
Techniques · 3
Primitives · 17
confidential-compute
Envelope encryption
security · medium: Encrypt each object with its own data key and wrap that key under a KMS-held key, so rotation re-wraps 60 bytes and deleting a key shreds data.
›
Measured boot
security · medium: Each boot stage hashes the next into TPM PCRs (extend) and logs events for later attestation
Remote attestation
security · medium: Hardware-signed evidence (TPM quotes, SGX/TDX quotes, SEV-SNP reports, key attestation) proving device, key or enclave state to a verifier
AEAD (AES-GCM, ChaCha20-Poly1305)
security · low: Authenticated encryption that encrypts and detects tampering in one call; the only kind of symmetric encryption you should use.
›
Trusted execution environments
security · low: Enclaves/confidential VMs with remote attestation for computing on sealed data
Hardware virtualization kvm
hardware-os · low: VT-x/AMD-V via KVM: vCPU run loop, VM exits, MMIO emulation
Virtio devices
hardware-os · low: Virtqueue rings for paravirtual block, net and vsock devices
Virtual memory and the TLB
hardware-os · low: How page tables and TLBs translate every address, what TLB reach means, and when 2 MiB or 1 GiB huge pages pay off on Linux.
›
Constant time code
security · low: Writing secret-dependent code without branches or memory lookups on secrets; constant-time compare and select
ECDH key exchange (X25519, P-256)
security · low: Each side multiplies the other's public curve point by its own scalar and both get the same point; always validate the peer key and run the result through a KDF.
›
HKDF key derivation (extract-and-ex…
security · low: HMAC-based two-step key derivation: extract a uniform pseudorandom key from any secret, then expand it into as many context-bound keys as you need.
›
Key sealing
security · low: Encrypting data so only a specific measured enclave/boot state can decrypt it (TPM/SGX sealing)
Least privilege and isolation
security · low: Assume every component will be compromised and limit what it can then reach: narrow identities, separate accounts, sandboxed processes.
›
Microarchitectural side channels
security · low: Cache timing (Prime+Probe, Flush+Reload) and speculative-execution (Spectre, Meltdown) leaks and their mitigations
Aes key wrap
security · low: AES Key Wrap (RFC 3394/5649) and AES-GCM-SIV for deterministic, authenticated wrapping of key material
Csprng
security · low: OS-backed cryptographically secure random numbers (getrandom), and when a fast PRNG is not enough
Cryptographic hashes (SHA-2, BLAKE3)
security · low: Collision-resistant fingerprints of data; SHA-256 for interoperability, BLAKE3 for speed, HMAC/HKDF for keyed uses.
›
Hardware backed keystore
security · low: Non-exportable keys in Secure Enclave, StrongBox, TPM: generation, use policies, biometric gating
Secure boot chain
security · low: Each boot stage verifies the signature of the next before running it, anchored in an immutable ROM key hash, with version counters against downgrade and a TPM log of what ran.
›
+ 1 more primitives
System
Techniques · 3
Primitives · 17
confidential-compute
Envelope encryption
security · medium: Encrypt each object with its own data key and wrap that key under a KMS-held key, so rotation re-wraps 60 bytes and deleting a key shreds data.
›
Measured boot
security · medium: Each boot stage hashes the next into TPM PCRs (extend) and logs events for later attestation
Remote attestation
security · medium: Hardware-signed evidence (TPM quotes, SGX/TDX quotes, SEV-SNP reports, key attestation) proving device, key or enclave state to a verifier
AEAD (AES-GCM, ChaCha20-Poly1305)
security · low: Authenticated encryption that encrypts and detects tampering in one call; the only kind of symmetric encryption you should use.
›
Trusted execution environments
security · low: Enclaves/confidential VMs with remote attestation for computing on sealed data
Hardware virtualization kvm
hardware-os · low: VT-x/AMD-V via KVM: vCPU run loop, VM exits, MMIO emulation
Virtio devices
hardware-os · low: Virtqueue rings for paravirtual block, net and vsock devices
Virtual memory and the TLB
hardware-os · low: How page tables and TLBs translate every address, what TLB reach means, and when 2 MiB or 1 GiB huge pages pay off on Linux.
›
Constant time code
security · low: Writing secret-dependent code without branches or memory lookups on secrets; constant-time compare and select
ECDH key exchange (X25519, P-256)
security · low: Each side multiplies the other's public curve point by its own scalar and both get the same point; always validate the peer key and run the result through a KDF.
›
HKDF key derivation (extract-and-ex…
security · low: HMAC-based two-step key derivation: extract a uniform pseudorandom key from any secret, then expand it into as many context-bound keys as you need.
›
Key sealing
security · low: Encrypting data so only a specific measured enclave/boot state can decrypt it (TPM/SGX sealing)
Least privilege and isolation
security · low: Assume every component will be compromised and limit what it can then reach: narrow identities, separate accounts, sandboxed processes.
›
Microarchitectural side channels
security · low: Cache timing (Prime+Probe, Flush+Reload) and speculative-execution (Spectre, Meltdown) leaks and their mitigations
Aes key wrap
security · low: AES Key Wrap (RFC 3394/5649) and AES-GCM-SIV for deterministic, authenticated wrapping of key material
Csprng
security · low: OS-backed cryptographically secure random numbers (getrandom), and when a fast PRNG is not enough
Cryptographic hashes (SHA-2, BLAKE3)
security · low: Collision-resistant fingerprints of data; SHA-256 for interoperability, BLAKE3 for speed, HMAC/HKDF for keyed uses.
›
Hardware backed keystore
security · low: Non-exportable keys in Secure Enclave, StrongBox, TPM: generation, use policies, biometric gating
Secure boot chain
security · low: Each boot stage verifies the signature of the next before running it, anchored in an immutable ROM key hash, with version counters against downgrade and a TPM log of what ran.
›
X509 certificates
security · low: Certificate chains, path validation, SANs, revocation and short-lived issuance
Copy for AI
Similar systems
Share the most building blocks with this one.
drm
17 %
full-disk-encryption
17 %
hsm-service
16 %
offline-finding
15 %