A trusted computing base (TCB) is every hardware, software, and firmware component that must be trusted to protect data and enforce security properties. Inside a trusted execution environment (TEE), think of it as the entire secure foundation beneath a computation. section 9.2.1
A bare-metal enclave begins with a minimal secure shell rather than a complete operating environment. Adding a Linux kernel and userspace expands the TCB, increasing the amount of code and infrastructure whose security must be trusted. section 9.2.1
A small TCB supports confidential computing by:
- Loading a WebAssembly module and minimal runtime instead of booting a full operating system. section 9.2.1
- Keeping security-critical code and systems limited to the components required by the computation. section 9.2.1
- Allowing multiple tenants to execute safely within one enclave through WebAssembly sandboxing. section 9.2.1
Replacing an operating system with a focused runtime
An enclave running a full Linux environment must trust substantially more code than one running only a WebAssembly module and minimal runtime. The latter can contain application logic written in Rust or Go, compiled to Wasm, while avoiding direct dependence on low-level C or C++ interfaces for enclave hardware such as Intel SGX or AMD SEV. section 9.2.1 section 9.5
