# Published Hardware Attacks # Published Hardware Attacks Published attacks have extracted identity or attestation keys from four families of security hardware; for NVIDIA’s data-centre GPUs, a search on 7 October 2026 found no published extraction. ## Identity and attestation keys extracted, by family of security hardware - Identity or attestation key extracted, verified - Partly verified, so not counted - A result on GPUs or GPU systems - AMD Secure ProcessorInsecure Until Proven Updated 2019One Glitch to Rule Them All 2021MilanLaunchy + BadFuse 2026 - Intel CSME and PTTTPM-Fail 2019 - Intel SGX and TDXForeshadow 2018SGAxe 2020ÆPIC Leak 2022Battering RAM 2025WireTap 2025TEE.fail 2025 - RISC-V KeystonePhysical Memory Please 2026 - NVIDIA’s data-centre GPUs (Hopper, Blackwell) No published extraction of an identity or attestation key. ## All 123 published results, by date and the access each needed Eleven verified results extracted an identity or attestation key; of the 17 physical attacks whose sources state a cost, 14 needed $1,000 of equipment or less. Each mark is one published result, at its date, in the row of the hardest access it needed. - Extracted an identity or attestation key - Forged attestation - Bypassed secure boot or rollback protection - Bypassed a performance limiter - Read or altered protected data - Hollow: partly verified against its sources - Ringed: TEE.fail, the selected result Show results on All platforms123 resultsTrusted execution environments in CPUs64 resultsGPUs and GPU systems29 resultsTrusted Platform Modules5 resultsBoot code and signing keys20 resultsStandalone security chips10 results Selected result: TEE.fail. Choose any mark on the chart to open its record. [Open this result’s record](https://scrutica.com/verification/attacks#panel-stack-attack) ## TEE.fail Previous94 of 123 results, in date orderNext Disclosed 28 Oct 2025, IEEE Symposium on Security and Privacy 2026 #### TEE.fail Chuang et al., _TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition_ It extracted an identity or attestation key from Intel SGX and TDX, with privileged software and physical access; its source puts the equipment at $1,000 or less. Defeated Key extraction, forged attestation, integrity and confidentiality. Key taken Intel SGX and TDX: Intel’s device-specific Provisioning Certification Key, from its Provisioning Certification Enclave. In the stack Breaks Hardware identity key, on Intel SGX and TDX; Remote attestation and Confidential computing, on the platforms listed as affected. The stack’s parts are generic and do not distinguish vendors. [Show what fails with them](https://scrutica.com/verification/stack#attack-A-teefail-2025) Scrutica’s inference: it also bears on Delay-based location, Workload attestation and On-chip compute metering. Platforms (3) - Intel Xeon Scalable 4th/5th Gen and Xeon 6 with DDR5 (TDX, SGX); attack demonstrated on 5th Gen Xeon Scalable - AMD EPYC Zen 4 and Zen 5 with SEV-SNP and DDR5 (authors’ statement); attack demonstrated on Zen 5 with Ciphertext Hiding - Relayed, no key taken: NVIDIA Confidential Computing attestation (H100) as consumed by dstack-based applications The keys it extracts are Intel’s, from SGX and TDX machines. NVIDIA’s attestation, as dstack-based applications consume it, was relayed from GPUs the attackers did not own: > Basically, the fact that Nvidia’s attestation reports are not bound to the identity of a specific CVM means we can ‘borrow’ Nvidia attestations from devices that aren’t ours. [tee.fail](https://tee.fail/), FAQ, Oct 2025 Quotations (6), all from the authors Needed > Moreover, our attack can be done in under $1000 by computer hobbyists using equipment readily available on the secondhand market. [tee.fail](https://tee.fail/files/paper.pdf), PDF p. 1, Sec. 1.1 > Performing the above steps on our target machine described in Section 3 in an UpToDate attestation status, our attack took about 2 minutes to create the ciphertext mapping, and 13 minutes to execute the PCE and trace the ECDSA signing. [tee.fail](https://tee.fail/files/paper.pdf), Sec. 6 Defeated > More specifically, we break SGX and TDX security guarantees by extracting attestation keys from machines in a fully trusted UpToDate attestation status. [tee.fail](https://tee.fail/files/paper.pdf), PDF p. 2, Sec. 1.1 Key taken > Combining this observation with Intel’s use of deterministic AES-XTS encryption, we are able to use our memory interposition setup to break the confidentiality of the PCE enclave, extracting its Provisioning Certification Key (PCK). [tee.fail](https://tee.fail/files/paper.pdf), PDF p. 2, Sec. 1.1 > The PCE derives a device-specific provisioning certification key (PCK) via EGETKEY on a root provisioning key and CPU version info. This PCK is a 256-bit ECDSA key and is used to certify the QE’s identity and its attestation key. [tee.fail](https://tee.fail/files/paper.pdf), PDF p. 9, Sec. 6.2 > As TEE.fail does not directly attack any Nvidia CC elements, there are no mitigations from the Nvidia CC side. In answer to Are there any mitigations? How do I protect myself with Nvidia CC?, [tee.fail](https://tee.fail/), FAQ, Oct 2025 Vendor responses (3) > This most recent research, released in a paper titled ‘TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition’, does not change Intel’s previous out of scope statement for these types of physical attacks. Intel, [intel.com](https://www.intel.com/content/www/us/en/security-center/announcement/intel-security-announcement-2025-10-28-001.html), 28 Oct 2025 > AMD does not plan to provide mitigations since physical vector attacks are out of scope for AMD SEV-SNP. AMD, [amd.com](https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3040.html), 28 Oct 2025 > Intel has indicated that it is impossible to issue a microcode to update the inner workings of the memory encryption engine. Intel, as reported by the authors, [tee.fail](https://tee.fail/files/paper.pdf), Oct 2025 NVIDIA: no public statement found as of 7 October 2026. ## Sources Sources Primary sources - Attack record: researchers’ papers and vendors’ advisories (115 publications) Research databases and literature - Attack record: repository and catalogue entries (3 publications) Press and analysts - Attack record: press reports (4 publications) Data [Open data downloads](https://scrutica.com/verification/attacks#panel-data) How the figures were made A result sits on the row of the most demanding access its source lists, a physical attack in the band of the equipment cost its source states, and is linked to the mechanisms of the verification stack it breaks or bears on. Attack records were checked against their sources on 6–8 October 2026. Partly verified ones are drawn hollow. **The attack record.** 123 published results from 122 publications, each placed by the hardest access it needed; 25 are only partly verified. Five more in the record are left off: four defeat no stated property, and one could not be verified. A physical result is drawn in the cheapest band that holds the setup cost its source states. Eight results are counted under two or more platforms and four under none, so the platform counts add to 128 for the 123 results. **The families.** A family is counted when a verified result has extracted a device-unique key that the hardware uses to prove its identity or attest its state. Searches for attacks on H100-class confidential computing and for GPU attestation-key extraction last ran on 7 October 2026, and none of the 29 results the record holds on GPUs and GPU systems extracts one. The quotation each family is counted on: - AMD Secure Processor: Using this patched SEV firmware, we extracted the SEV state, see Section 3.1, including the CEK private key of three different AMD Epyc CPUs. (Insecure Until Proven Updated 2019, [arxiv.org](https://arxiv.org/pdf/1908.11680), PDF p. 7, Sec. 3.3). - Intel CSME and PTT: We generated a unique ECDSA attestation key (AK) using the Intel fTPM device on the VPN server. (TPM-Fail 2019, [usenix.org](https://www.usenix.org/system/files/sec20-moghimi-tpm.pdf), p. 2067). - Intel SGX and TDX: Using Foreshadow we have successfully extracted the attestation keys, used by the Intel Quoting Enclave to vouch for the authenticity of enclaves. (Foreshadow 2018, [foreshadowattack.eu](https://foreshadowattack.eu/)). - RISC-V Keystone: Using this primitive, we demonstrate end-to-end attacks on the popular RISC-V Keystone TEE, achieving full enclave memory disclosure and, ultimately, completely undermining remote attestation guarantees by extracting the long-term platform measurement key. (Physical Memory Please 2026, [ojs.ub.rub.de](https://ojs.ub.rub.de/index.php/uASC/article/download/12712/12391/16024), Abstract). Not counted: 3 partly verified, 2 other kinds of key, 6 other families. Partly verified: - Intel CSME and PTT: Intel CSME boot-ROM IOMMU window 2019. - Intel SGX and TDX: SGX.Fail 2022 and Intel SGX Fuse Key0 extraction on Gemini Lake 2024. Other kinds of key from the four families: - AMD Secure Processor: Google Project Zero / Google Cloud security review of the AMD Secure Processor 2022 (part of an identity key: parts of the SEV Platform Endorsement Key’s private ECDSA scalar). - Intel SGX and TDX: Downfall 2023 (another kind of key: an SGX sealing key from a test enclave, with no attestation key decrypted). Families with no counted extraction: - Google Titan M: Attacking Titan M with Only One Byte 2022 (another kind of key: keys protected by StrongBox, with no statement that the device attestation key was among them). - Infineon security controller: EUCLEAK 2024 (another kind of key: one account’s FIDO credential key, with no report that the attestation key was extracted). - NXP secure element: A Side Journey to Titan 2021 (another kind of key: a per-account FIDO credential key). - Raspberry Pi RP2350: Antifuse OTP secret extraction by focused-ion-beam passive voltage contrast 2025 (no whole key: the bitwise OR of two adjacent antifuse rows). - Samsung TrustZone Keymaster: Samsung TrustZone Keymaster key extraction 2022 (another kind of key: hardware-protected keys of Android apps, among them the private key of a FIDO2 WebAuthn credential). - STMicroelectronics TPM: TPM-Fail 2019 (another kind of key: an ECDSA signing key of no stated kind). - Primary: a document cited for its own text, such as a law, a filing, a vendor’s documentation, a measurement, or an author’s report for what it proposes or finds. - Research: a research database or study, cited for a fact it reports from elsewhere. - Press or analyst: news reporting or an analyst’s account.