There’s a few components that are necessary to make it work:

1. The provider open sources the code running in the enclave and pins the measurement to a transparency log such as Sigstore

2. On each connection, the client SDK fetches the measurement of the code actually running (through a process known as remote attestation)

3. The client checks that the measurement that the provider claimed to be running exactly matches the one fetched at runtime.

We explain this more in a previous blog: https://tinfoil.sh/blog/2025-01-13-how-tinfoil-builds-trust

▲

LoganDark 2 hours ago | parent [-]

What enclave are you using? Is it hardware-backed?

Edit: I found https://github.com/tinfoilsh/cvmimage which says AMD SEV-SNP / Intel TDX, which seems almost trustworthy.

▲

FrasiertheLion 2 hours ago | parent [-]

Yes, we use Intel TDX/AMD SEV-SNP with H200/B200 GPUs configured to run in Nvidia Confidential Computing mode

▲

LoganDark 2 hours ago | parent [-]

I would be interested to see Apple Silicon in the future, given its much stronger isolation and integrity guarantees. But that is an entirely different tech stack.

▲

julesdrean an hour ago | parent [-]

Apple does something very similar with Apple Private Cloud Compute. It's interesting cause their isolation argument is different. For instance, memory is not encrypted (so weaker protection against physical attacks), but they measure and guarantee integrity (and need to trust) all code running on the machine, not just inside the secure enclave.

Good question is how many lines of code do you need to trust at the end of the day between these different designs.

	▲	LoganDark 29 minutes ago \| parent [-]
		Lines of code hardly means anything, but I'd believe Apple has far fewer, given how aggressively they curtail their platforms rather than letting them collect legacy cruft.