TEE Tutorial:
Dstack and Coprocessor apps
Andrew Miller
Jan 7
IC3 Winter’25 Retreat
TEE Usecases at a high level
TEE Background (TDX vs SGX)
Dstack https://docs.phala.network/dstack� Confidential VM� Applications as Containers in a base VM� All you need is remote attestation� TEE as blockchain coprocessors
Hands on demo and tutorial� If you can run Docker, you can play along!
How TEEs disintermediate app developers and clouds
TEE Manufacturer
TEE operators
Developers
Inspect evidence
and attestations
Contribute sensitive data
TEE
Self-contained example:
Trusted Setup using a TEE
TEE
Samples p and q
Computes N = pq
Throw away p,q
Output N
N, att
Inspect the source code
CheckAtt(att, policy, N)
Relying parties
TEE Manufacturer
Certificate chain
If you put a Smart Contract in a TEE, � it gets upgraded with programmable privacy
TEE framework
Smart Contract VMs
AMM� DeFi Lending
Programmable Privacy
DarkPool AMM
Snipe-resistant Lending
If you put a builder in a TEE, � it comes out trust minimized
TEE framework
Simulation and ordering rules are followed
Bidding/refund rules are followed�
Pre-trade and failed-trade privacy respected
Trusted-party�Centralized �Builder
If you put an unfinished L2 sequencer in a TEE, � it comes out a validium with proactive security
TEE framework
ZK Prover
2FA prover
MPC
Collusion resistant MPC
If you put any Web2 service in TEE it comes out Web3
Backends
Frontends
TEE framework
Decentralized Frontends
Fractionalized Web2 accounts
Permissionless composition
Credentials put inside a TEE turn Web2 into digital assets
“post (just once)”
tokens
TEE framework
Fine-grained delegation
OAuth Session Credentials
Entire account
Smart contracts that can fully manage the account
AI agents placed inside a TEE become credible
Credible AI agents
TEE framework
AI Agent
Might simply be puppeteered by humans
- verifiable source code (optional proprietary parameters)
- audit logs
- exclusively owned accounts
TEE: Trusted and Untrusted interfaces
Untrusted OS Kernel
Trusted Enclave Process
Untrusted Hypervisor
Trusted Guest VM (CVM)
SGX (process based TEE)
TDX (VM based TEE)
Kernel controls page tables, threads/events, interrupts
Hypervisor controls extended page tables, external interrupts
SGX vs TDX/SEV vs AWS Nitro
SGX: process based, widely deployed on 3rd gen Xeons+
TDX: confidential VM based, available on 4th gen Xeons+
SEV: confidential VM based, available on AMD
AWS Nitro: confidential VM based, but the hardware is not publicly available
NVIDIA h100 and h200: GPU support a TEE mode
Proof of Cloud - a complement to hardware attestation
meta-confidential-compute�tdx
meta-podman
yocto base
Application container
Dstack as a Base VM for application containers
sgx
seal
Provides access to remote attestation
For persistence
Security-oriented embedded kernel
Dstack Base VM
App container
Applications need to request Remote Attestation
Public key endorsed by Intel
Signed by an on-chip key
Payload specified by application
Hash of program binary
Processor/Bios configuration
On-chain Key Management
Upgrade Operator - Blockchain controlled upgrades
TEE as a blockchain coprocessor
Smart Contract
Off-chain & confidential functions
On-chain functions
Compute Nodes
Validators
Users
Ciphertexts
xPriv
Attested results
Light client
EVM, other code
Follow Along Tutorial - dstack simulator
1. Install Docker on your laptop.
Then follow: https://docs.phala.network/dstack/getting-started
https://github.com/Dstack-TEE/dstack-examples
2. For Coprocessor apps: we’ll need an ETH RPC URL.
The free “endpoint” of quicknode works
3. Run the tappd simulator
4. Run your app container
Quicknode setup
Exploring remote attestations