"They don't care about this": A Systematic Study of TEE Build Reproducibility in the Wild
91% of 115 surveyed TEE deployments across Intel SGX, TDX, and AMD SEV fail to provide reproducible builds needed for verifiable remote attestation.
A systematic study of 115 TEE deployments found 91% were not reproducible and 80% lacked both source code and a reference build, undermining remote attestation guarantees. Interviews with 12 developers of 50 Intel SGX projects confirmed that only one participant treats reproducibility as a development priority. The authors identify technical barriers such as embedded timestamps plus ecosystem-level issues like lack of build-environment control in multi-stakeholder projects, and call for holistic, committed reproducibility practices.
- 91% of 115 TEE deployments were not reproducible
- 80% lacked both source code and a reference build
- Only 1 of 12 interviewed SGX developers prioritizes reproducibility
- Study spans Intel SGX, Intel TDX, and AMD SEV
- Recommends ecosystem-level changes rather than treating TEEs as a security badge
From the original article
1 min read at arxiv.orgTrusted Execution Environments (TEEs) have become a cornerstone of modern cloud computing, providing strong confidentiality and integrity guarantees for both code and data. A critical component of this trust model is remote attestation, which enables external entities to verify the authenticity and integrity of code executing within a TEE through cryptographic measurements.
By Annika Wilde · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.