# What is Confidential Computing?

> Confidential computing protects data in use by performing computation within a hardware-backed, attested trusted execution environment (TEE).

- Canonical URL: https://yellowcube.eu/glossary/confidential-computing/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The environment is intended to isolate specified code and data from other software and, under its threat model, from some highly privileged operators. This complements protections for data at rest and in transit rather than replacing them.

A confidential-computing design defines what enters the TEE, which components remain trusted, and how secrets are released. Remote attestation supplies evidence about an environment and its measured state for appraisal against policy; it should be tied to workload identity, freshness, software approval, key release, updates, and revocation.

### Key points

- **Threat model and boundary:** State which hardware, firmware, monitor, runtime, workload, administrators, and external services are trusted, and which host or cloud privileges the environment is expected to resist.
- **Attestation policy:** Authenticate the evidence source, check freshness and approved measurements, retain appraisal rules, and decide what access or key release follows each result.
- **Operations:** Protect images and build provenance, minimize the trusted computing base, patch platform components, control inputs and outputs, rotate secrets, and plan recovery when hardware or measurements change.
- **Important limitation:** Isolation and attestation do not prove that workload code is correct or safe. Side channels, implementation flaws, malicious inputs, exposed outputs, denial of service, compromised endpoints, and hardware or supply-chain weaknesses may remain; attestation is evidence evaluated under policy, not a guarantee.

### Related terms

[Encryption](<https://yellowcube.eu/glossary/encryption/>) · [Homomorphic encryption](<https://yellowcube.eu/glossary/homomorphic-encryption/>) · [Data protection](<https://yellowcube.eu/glossary/data-protection/>) · [Cloud security](<https://yellowcube.eu/glossary/cloud-security/>) · [Hardware security module (HSM)](<https://yellowcube.eu/glossary/hardware-security-module/>)

### Sources

[Confidential Computing Consortium, Common Terminology for Confidential Computing](https://confidentialcomputing.io/wp-content/uploads/sites/10/2023/03/Common-Terminology-for-Confidential-Computing.pdf) · [NIST IR 8320, Hardware-Enabled Security: Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases](https://csrc.nist.gov/pubs/ir/8320/final) · [RFC 9334, Remote ATtestation procedureS (RATS) Architecture](https://www.rfc-editor.org/info/rfc9334/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.