Intel Ends SGX with Diamond Rapids: Future Xeon Processors to Prioritize TDX Over Enclaves
Technologies don't always disappear because they fail; sometimes, the rest of the industry simply moves in a different direction. This appears to be the case for Intel SGX (Software Guard Extensions). On October 9, 2026, Intel confirmed a fundamental shift in its security strategy for server processors: the upcoming Xeon generation, codenamed Diamond Rapids, will be the last platform to support SGX. Moving forward, the manufacturer will focus on TDX (Trust Domain Extensions) and hardware-based isolation for entire virtual machines.
In an official statement, Intel's Mike Ferron-Jones, responsible for platform security and integrity technologies, highlighted the growing importance of Confidential Computing for cloud services, AI applications, and regulated enterprise environments. While SGX won't vanish overnight—existing platforms will continue to receive security updates and support into the early 2030s—the decision sets a definitive boundary for the technology's roadmap in the server market.
Different Models: Why TDX is Not a Simple Replacement for SGX
It is crucial to distinguish between the two security models. While both fall under the umbrella of Confidential Computing, they serve different purposes. Intel SGX allows applications to execute sensitive code and data within protected "enclaves." These memory regions are shielded from other software components, including privileged system software. However, this requires applications or their runtimes to be specifically designed for SGX, which can complicate integration and increase development overhead.
Intel TDX takes a much broader approach. Instead of isolating specific parts of an application, it protects an entire virtual machine (VM) within a "Trust Domain." This allows large-scale applications and their operating systems to be isolated without requiring every individual software component to be modified for SGX compatibility. This scalability is why major cloud providers, including Microsoft Azure, Google Cloud, Alibaba Cloud, IBM Cloud, and Volcano Cloud, are already integrating TDX-based services.
The AI Factor and Cross-Component Security
The strategic pivot toward TDX is also driven by the demands of modern AI workloads. In contemporary data centers, computations are often distributed across CPUs and GPU accelerators. A security model limited strictly to the processor creates potential attack surfaces during data transfers between components. To address this, Intel is collaborating with NVIDIA to advance Intel TDX Connect, aiming to bridge the gap between CPU and GPU security boundaries and ensure trusted data paths across hardware components.
Furthermore, Intel is exploring post-quantum cryptography and enhanced attestation methods. Attestation allows a system to cryptographically verify that a protected execution environment possesses the expected properties before sensitive data is handed over. However, it is important to note that the mention of these features in the roadmap does not guarantee they will all be fully implemented and available in the Diamond Rapids generation.
Editorial Verdict
In my view, this announcement is less about the
Зануда
