Published Hardware Attacks

Published attacks have extracted identity or attestation keys from four families of security hardware; for NVIDIA’s data-centre GPUs, a search on 7 October 2026 found no published extraction.

Identity or attestation key extracted, verified
Partly verified, so not counted
A result on GPUs or GPU systems

AMD Secure Processor
Intel CSME and PTT
Intel SGX and TDX
RISC-V Keystone
NVIDIA’s data-centre GPUs (Hopper, Blackwell) No published extraction of an identity or attestation key.

All 123 published results, by date and the access each needed

Eleven verified results extracted an identity or attestation key; of the 17 physical attacks whose sources state a cost, 14 needed $1,000 of equipment or less.

Each mark is one published result, at its date, in the row of the hardest access it needed.

Extracted an identity or attestation key
Forged attestation
Bypassed secure boot or rollback protection
Bypassed a performance limiter
Read or altered protected data
Hollow: partly verified against its sources
Ringed: TEE.fail, the selected result

Show results on

All platforms123Trusted execution environments in CPUs64GPUs and GPU systems29Trusted Platform Modules5Boot code and signing keys20Standalone security chips10

Selected result: TEE.fail. Choose any mark on the chart to open its record. Open this result’s record

TEE.fail

94 of 123

Disclosed 28 Oct 2025, IEEE Symposium on Security and Privacy 2026

TEE.fail

Chuang et al., TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition

It extracted an identity or attestation key from Intel SGX and TDX, with privileged software and physical access; its source puts the equipment at $1,000 or less.

Defeated

Key extraction, forged attestation, integrity and confidentiality.

Key taken

Intel SGX and TDX: Intel’s device-specific Provisioning Certification Key, from its Provisioning Certification Enclave.

In the stack

Breaks Hardware identity key, on Intel SGX and TDX; Remote attestation and Confidential computing, on the platforms listed as affected. The stack’s parts are generic and do not distinguish vendors.

Show what fails with them

Scrutica’s inference: it also bears on Delay-based location, Workload attestation and On-chip compute metering.

Platforms (3)

Intel Xeon Scalable 4th/5th Gen and Xeon 6 with DDR5 (TDX, SGX); attack demonstrated on 5th Gen Xeon Scalable
AMD EPYC Zen 4 and Zen 5 with SEV-SNP and DDR5 (authors’ statement); attack demonstrated on Zen 5 with Ciphertext Hiding
Relayed, no key taken: NVIDIA Confidential Computing attestation (H100) as consumed by dstack-based applications

The keys it extracts are Intel’s, from SGX and TDX machines. NVIDIA’s attestation, as dstack-based applications consume it, was relayed from GPUs the attackers did not own:

Basically, the fact that Nvidia’s attestation reports are not bound to the identity of a specific CVM means we can ‘borrow’ Nvidia attestations from devices that aren’t ours.

tee.fail, FAQ, Oct 2025

Quotations (6), all from the authors

Needed

Moreover, our attack can be done in under $1000 by computer hobbyists using equipment readily available on the secondhand market.

tee.fail, PDF p. 1, Sec. 1.1

Performing the above steps on our target machine described in Section 3 in an UpToDate attestation status, our attack took about 2 minutes to create the ciphertext mapping, and 13 minutes to execute the PCE and trace the ECDSA signing.

tee.fail, Sec. 6

Defeated

More specifically, we break SGX and TDX security guarantees by extracting attestation keys from machines in a fully trusted UpToDate attestation status.

tee.fail, PDF p. 2, Sec. 1.1

Key taken

Combining this observation with Intel’s use of deterministic AES-XTS encryption, we are able to use our memory interposition setup to break the confidentiality of the PCE enclave, extracting its Provisioning Certification Key (PCK).

tee.fail, PDF p. 2, Sec. 1.1

The PCE derives a device-specific provisioning certification key (PCK) via EGETKEY on a root provisioning key and CPU version info. This PCK is a 256-bit ECDSA key and is used to certify the QE’s identity and its attestation key.

tee.fail, PDF p. 9, Sec. 6.2

As TEE.fail does not directly attack any Nvidia CC elements, there are no mitigations from the Nvidia CC side.

In answer to Are there any mitigations? How do I protect myself with Nvidia CC?, tee.fail, FAQ, Oct 2025

Vendor responses (3)

This most recent research, released in a paper titled ‘TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition’, does not change Intel’s previous out of scope statement for these types of physical attacks.

Intel, intel.com, 28 Oct 2025

AMD does not plan to provide mitigations since physical vector attacks are out of scope for AMD SEV-SNP.

AMD, amd.com, 28 Oct 2025

Intel has indicated that it is impossible to issue a microcode to update the inner workings of the memory encryption engine.

Intel, as reported by the authors, tee.fail, Oct 2025

NVIDIA: no public statement found as of 7 October 2026.

Sources

Primary sources

Attack record: researchers’ papers and vendors’ advisories (115 publications)

Research databases and literature

Attack record: repository and catalogue entries (3 publications)

Press and analysts

Attack record: press reports (4 publications)

Data

Open data downloads

How the figures were made

A result sits on the row of the most demanding access its source lists, a physical attack in the band of the equipment cost its source states, and is linked to the mechanisms of the verification stack it breaks or bears on. Attack records were checked against their sources on 6–8 October 2026. Partly verified ones are drawn hollow.

The attack record. 123 published results from 122 publications, each placed by the hardest access it needed; 25 are only partly verified. Five more in the record are left off: four defeat no stated property, and one could not be verified. A physical result is drawn in the cheapest band that holds the setup cost its source states. Eight results are counted under two or more platforms and four under none, so the platform counts add to 128 for the 123 results.

The families. A family is counted when a verified result has extracted a device-unique key that the hardware uses to prove its identity or attest its state. Searches for attacks on H100-class confidential computing and for GPU attestation-key extraction last ran on 7 October 2026, and none of the 29 results the record holds on GPUs and GPU systems extracts one.

The quotation each family is counted on:

AMD Secure Processor: Using this patched SEV firmware, we extracted the SEV state, see Section 3.1, including the CEK private key of three different AMD Epyc CPUs. (Insecure Until Proven Updated 2019, arxiv.org, PDF p. 7, Sec. 3.3).
Intel CSME and PTT: We generated a unique ECDSA attestation key (AK) using the Intel fTPM device on the VPN server. (TPM-Fail 2019, usenix.org, p. 2067).
Intel SGX and TDX: Using Foreshadow we have successfully extracted the attestation keys, used by the Intel Quoting Enclave to vouch for the authenticity of enclaves. (Foreshadow 2018, foreshadowattack.eu).
RISC-V Keystone: Using this primitive, we demonstrate end-to-end attacks on the popular RISC-V Keystone TEE, achieving full enclave memory disclosure and, ultimately, completely undermining remote attestation guarantees by extracting the long-term platform measurement key. (Physical Memory Please 2026, ojs.ub.rub.de, Abstract).

Not counted: 3 partly verified, 2 other kinds of key, 6 other families.

Partly verified:

Intel CSME and PTT: Intel CSME boot-ROM IOMMU window 2019.
Intel SGX and TDX: SGX.Fail 2022 and Intel SGX Fuse Key0 extraction on Gemini Lake 2024.

Other kinds of key from the four families:

AMD Secure Processor: Google Project Zero / Google Cloud security review of the AMD Secure Processor 2022 (part of an identity key: parts of the SEV Platform Endorsement Key’s private ECDSA scalar).
Intel SGX and TDX: Downfall 2023 (another kind of key: an SGX sealing key from a test enclave, with no attestation key decrypted).

Families with no counted extraction:

Google Titan M: Attacking Titan M with Only One Byte 2022 (another kind of key: keys protected by StrongBox, with no statement that the device attestation key was among them).
Infineon security controller: EUCLEAK 2024 (another kind of key: one account’s FIDO credential key, with no report that the attestation key was extracted).
NXP secure element: A Side Journey to Titan 2021 (another kind of key: a per-account FIDO credential key).
Raspberry Pi RP2350: Antifuse OTP secret extraction by focused-ion-beam passive voltage contrast 2025 (no whole key: the bitwise OR of two adjacent antifuse rows).
Samsung TrustZone Keymaster: Samsung TrustZone Keymaster key extraction 2022 (another kind of key: hardware-protected keys of Android apps, among them the private key of a FIDO2 WebAuthn credential).
STMicroelectronics TPM: TPM-Fail 2019 (another kind of key: an ECDSA signing key of no stated kind).

Primary: a document cited for its own text, such as a law, a filing, a vendor’s documentation, a measurement, or an author’s report for what it proposes or finds.
Research: a research database or study, cited for a fact it reports from elsewhere.
Press or analyst: news reporting or an analyst’s account.

Published Hardware Attacks

Identity and attestation keys extracted, by family of security hardware

Sources