[etaioinshrdlu]

Could you talk more about how how this works? I don't think linked article doesn't given enough detail on how the trust boundary extends from CPU to GPU.

Does the CPU have the ability to see unencrypted data?

[natesales]

The keys are generated on the CPU and never leave the enclave, but the data is decrypted on the CPU so it hits the registers in plaintext.

When the enclave starts, the CPU does a few things:

1. The CPU does a key exchange with the GPU (in confidential compute mode [1]) to derive a key to encrypt data over PCIe

2. The CPU verifies the integrity of the GPU against NVIDIA's root of trust [2]

[1] https://developer.nvidia.com/blog/confidential-computing-on-...

[2] https://github.com/tinfoilsh/cvmimage/blob/b65ced8796e8a8687...

edit: formatting