At one o'clock in the morning on July 29th, 1943, Winston Churchill and Franklin Roosevelt spoke by telephone about Italy. Mussolini had fallen four days earlier, and an armistice was coming. The call crossed the Atlantic on the Bell Labs A-3 scrambler, the best voice security of its day. Within hours a transcript of the call was in the war diary of the German high command.
Now, the A-3 was not built by amateurs, but it was sold commercially, so the Deutsche Reichspost could study it, and break it. From a station on the Dutch coast, their engineers unscrambled Allied transatlantic calls in near real time from 1941 to 1945, thirty to sixty a day. Nobody on the Allied side knew until after the war.
Its replacement, SIGSALY, was placed in service in 1943. It digitized speech and masked it with a one-time key of random noise pressed onto phonograph records, one for each end of the call, destroyed after use. SIGSALY's security was a provable property of the mathematics: a key as long as the message and never reused is the one construction cryptography has ever shown to be unconditionally secure. The Germans recorded SIGSALY traffic and could do nothing with it. The price was measured in what we now call SWaP-C: where the A-3 was a few racks of telephone equipment, a SIGSALY terminal was forty racks, 55 tons, 2,500 square feet and 30 kilowatts.
The A-3 was the TEE of its time
Vacuum tubes aside, the A-3 made exactly the promise confidential computing makes today: a well-engineered box takes your sensitive data, does something useful with it, and keeps it hidden from everyone else. The trust model rests on the box being what its maker says it is, holding up against people who can study it, and never falling into their hands. That is every Trusted Execution Environment (TEE): Intel SGX and TDX, AMD SEV-SNP, Arm CCA, Nvidia's confidential mode on the H100. A remote user checks a signed "attestation" that the box is genuine and contains only the expected code, and on that basis hands over the keys. It is a reasonable engineering idea, widely sold as a substitute for cryptographic privacy. The flaw is the one the Allies learned about in 1945: the security claim is about the box, not about the math.
Problem 1: broken from a distance
The Reichspost team never touched an A-3 terminal; they sat across the North Sea with a receiver and a model of how the machine worked. The modern record for TEEs reads the same way. Foreshadow (2018) pulled data out of SGX enclaves, including the keys that underpin attestation. Plundervolt (2019) induced faults inside an enclave purely from software. SGAxe (2020) extracted attestation keys and broke remote attestation outright. ÆPIC Leak (2022), Downfall (2023) and CacheWarp (2024) leaked enclave contents through architectural bugs on Intel and AMD. Several of these attacks compromised attestation, the only thing a remote party ever sees. When the signing key leaks, a compromised enclave goes on swearing it is genuine, and no user can tell. Similarly, the Reichspost station did not need to break every call. It just needed the A-3 to keep seeming secure to the people using it.
Problem 2: broken for good, up close
Remote attacks get patched, until the next one. Physical attacks do not, because TEE vendors have decided they need not be. In the autumn of 2025 three research groups published hardware attacks within weeks of each other. Battering RAM used a fifty-dollar DDR4 interposer to defeat both SGX and SEV-SNP, attestation included. WireTap passively tapped the memory bus and recovered an SGX attestation key. TEE.fail extended the technique to DDR5 for about a thousand dollars, against Intel TDX, AMD SEV-SNP and the Nvidia H100 confidential-computing chain that depends on them. Intel's and AMD's response was consistent and, in its way, admirably honest: physical attacks on the memory bus are outside the threat model. Said differently, confidential computing aims to protect you against a hostile operating system and a hostile hypervisor, but it does not aim to protect you against someone who has access to the server.
Problem is, the whole point of secure computation is that the adversary can have the device. A cloud operator, a technician, a government with a warrant, or a thief with a van all stand on the wrong side of the TEE's chosen security boundary. SIGSALY's modern equivalent, Fully Homomorphic Encryption (FHE), draws no such line: the server is assumed hostile from the first instruction, and the data never exists in the clear on it, in memory, on the bus or in cache.
Problem 3: a root of trust you can't hold in your head
The third problem with TEEs explains why the first two keep recurring. The Kriegsmarine held formal inquiries into whether Enigma had been compromised, first in 1941 and again in 1943, and each time concluded the machine was secure and blamed spies or radar for security failures. They were not fools. The system they had to reason about was complicated: the machine plus the key sheets plus the indicator procedure plus operator habits plus the distribution of all of it. No one could hold the whole in their head, so each piece was certified alone and the whole was assumed. All the while, Bletchley Park was reading their traffic through the seams between the pieces.
A TEE's root of trust has the same shape. To believe a TEE is secure you must believe in the microcode, the management-engine or Platform Security Processor firmware, the memory encryption mode, the vendor's attestation services, its signing keys and the people who hold them, the hypervisor interface, and the supply chain. The claim is "nothing in this list is wrong," but most of the list is closed to outside review, and at this size the full security story cannot realistically be proven, only audited, piece by piece, by the vendor's own staff. FHE's root of trust is a single sentence: the hardness of the Ring Learning With Errors problem. That assumption is public, has been attacked in the open for roughly twenty years with no result that threatens the parameters in use, and is the foundation NIST chose for ML-KEM, the post-quantum standard the internet is migrating to. One trust model is a theorem you can read. The other is a list you can only hope is complete.
The regulators draw the line
On November 5 the distinction between a theorem and a list became official guidance in Europe. The Spanish and Greek data protection authorities (AEPD and HDPA) published a joint guide on Secure Processing Environments, the legal construct the EU Data Governance Act and the European Health Data Space rely on for research access to sensitive data. It is unambiguous: "TEEs by themselves shall not be considered as Secure Processing Environments (SPEs), although they may support the implementation of a SPE." Its reasons are the ones above: TEE internals are "closed-source and opaque," "even remote attestation services may not be transparent," and they carry "possible vulnerabilities to side-channel attacks." Homomorphic encryption sits on the other side of the line, named among the "advanced data protection engineering techniques" that strengthen an SPE and "a suitable foundation when data users need to perform operations on numeric values." The guide is equally clear that no technique is a panacea. But the structure is the point: a mathematical technique is a building block for a secure environment; a TEE is something that may help you build one, but is not a full solution.
Fifty-five tons
SIGSALY was absurd: fifty-five tons, an air-conditioned room, a staff of technicians and a courier service for phonograph records, so that two men could talk. The Allies built a dozen anyway, because they had learned what cryptographic security was worth against an adversary with time and a receiver. Nobody in 1943 argued that the A-3 was good enough because SIGSALY was heavy. They argued about how to make SIGSALY lighter.
That is where we are with privacy today. FHE is the one approach to computing on sensitive data whose security does not depend on a box behaving itself, and its cost has always been the objection. The objection is real, but it is an engineering problem, and engineering problems get solved by building the right machine. Trust problems get solved by learning, after the fact, that someone on the Dutch coast has been listening the whole time.
David W. Archer is CTO and co-founder of Niobium, which builds hardware accelerators for fully homomorphic encryption.
To learn more about FHE, hardware acceleration, and Niobium's encrypted cloud platform, The Fog™, contact us or sign up to create a Fog account and start building today.
