--- title: Don't let TEEs break your MPC | daily.dev description: Combining threshold signature schemes (a form of multi-party computation) with trusted execution environments can strengthen security, but only when the TEE is... canonical: https://daily.dev/posts/don-t-let-tees-break-your-mpc-v2w5xnedg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Don't let TEEs break your MPC | daily.dev og:description: Combining threshold signature schemes (a form of multi-party computation) with trusted execution environments can strengthen security, but only when the TEE is... og:url: https://daily.dev/posts/don-t-let-tees-break-your-mpc-v2w5xnedg og:image: https://api.daily.dev/og/posts/v2W5XNeDG.png og:image:alt: Don't let TEEs break your MPC og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Don't let TEEs break your MPC **[Trail of Bits Blog](https://daily.dev/sources/trail-of-bits)** · 14 min read · 0 upvotes · 0 comments ## Summary Combining threshold signature schemes (a form of multi-party computation) with trusted execution environments can strengthen security, but only when the TEE is treated as a defense-in-depth layer rather than a substitute for a sound protocol. The post explains how TEE attestation works, how MPC's distributed-trust model clashes with a TEE's manufacturer-centralized trust, and which classes of MPC vulnerabilities (ambiguous hash encodings, misbehaving participants, missing Fiat-Shamir parameters, missing input validation) attestation can mitigate versus which it cannot (side channels, protocol-level nonce reuse). A detailed rollback-attack case shows how a malicious host can roll back filesystem state to force reuse of a threshold-signature pre-signature, leaking a private key share. It catalogs common pitfalls (incomplete attestation measurements, missing verification steps, lack of hardening, insecure backups, side-channel and physical attacks like TEE Fail and DDRop, centralization risk, insecure vendor defaults) and recommends best practices: binding attestation to party identity, terminating P2P connections inside TEEs, constant-time code, consulting vendor guidance, and using multiple TEE vendors for defense in depth. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can a malicious host break a threshold signature scheme running inside a TEE? A malicious host can roll back the filesystem state after a threshold signer deletes a used pre-signature file. When the TEE later fetches that rolled-back pre-signature, the signer unknowingly reuses their nonce share, which leaks their private key share, similar to classic nonce reuse attacks on Schnorr and ECDSA signatures outside TEEs. _Teams hardening threshold-signature deployments can track emerging TEE attack patterns like this one on daily.dev._ ### What does TEE attestation actually verify and what are its limitations for securing multi-party computation? TEE attestation lets remote parties cryptographically verify what code runs inside the enclave by checking a signed quote containing hashes of code, data, and configuration against a trusted root certificate and known-good measurements. Its limitations include vendor-specific and sometimes incomplete verification checks, measurements that can omit critical components (as happened with WhatsApp Private Inference's LD_PRELOAD vulnerability), and the fact that it cannot prevent host-level attacks like rollback, side-channels, or physical memory interposition. _Engineers designing attestation flows for MPC can follow this kind of security analysis on daily.dev._ ### What physical attacks have been demonstrated against Intel TDX and AMD SEV-SNP TEEs? The TEE Fail attack uses a memory interposition device to physically inspect all DDR5 memory traffic, breaking confidentiality guarantees of Intel TDX and AMD SEV-SNP. The newer DDRop attack goes further, using an interposer costing under $200 to silently drop DDR5 writes so the processor keeps reading stale but validly decrypting data, breaking integrity guarantees of Intel TDX, Scalable SGX, and AMD SEV-SNP alike. _Developers evaluating confidential computing hardware can keep up with disclosures like these on daily.dev._ ## Similar posts on daily.dev - [MPC, HSM, and TEE Explained: A Developer’s Guide to Key Management Technologies in Wallet Infrastructure](https://daily.dev/posts/mpc-hsm-and-tee-explained-a-developer-s-guide-to-key-management-technologies-in-wallet-infrastruc-ksotvpjk3) · Coins Bench · 0 upvotes · 0 comments - [Schneier on Security](https://daily.dev/posts/schneier-on-security-cuqphdwoq) · Schneier on Security · 0 upvotes · 0 comments - [Remote Attestation](https://daily.dev/posts/remote-attestation-ruafpolza) · Hacker News · 0 upvotes · 0 comments --- Tags: [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/don-t-let-tees-break-your-mpc-v2w5xnedg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Don't let TEEs break your MPC","url":"https://daily.dev/posts/don-t-let-tees-break-your-mpc-v2w5xnedg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/don-t-let-tees-break-your-mpc-v2w5xnedg"},"datePublished":"2026-10-11T12:29:41.421Z","dateModified":"2026-10-11T12:33:54.935Z","description":"Combining threshold signature schemes (a form of multi-party computation) with trusted execution environments can strengthen security, but only when the TEE is...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4bdded44b81df617a34b07a6c11da2b3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4bdded44b81df617a34b07a6c11da2b3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Trail of Bits Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trail of Bits Blog","logo":"https://media.daily.dev/image/upload/s--TLbYx4ip--/f_auto,q_auto/v1780213255/logos/trail-of-bits?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trail-of-bits"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/don-t-let-tees-break-your-mpc-v2w5xnedg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cryptography","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trail of Bits Blog","item":"https://daily.dev/sources/trail-of-bits"},{"@type":"ListItem","position":3,"name":"Don't let TEEs break your MPC"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/don-t-let-tees-break-your-mpc-v2w5xnedg#faq","mainEntity":[{"@type":"Question","name":"How can a malicious host break a threshold signature scheme running inside a TEE?","acceptedAnswer":{"@type":"Answer","text":"A malicious host can roll back the filesystem state after a threshold signer deletes a used pre-signature file. When the TEE later fetches that rolled-back pre-signature, the signer unknowingly reuses their nonce share, which leaks their private key share, similar to classic nonce reuse attacks on Schnorr and ECDSA signatures outside TEEs. Teams hardening threshold-signature deployments can track emerging TEE attack patterns like this one on daily.dev."}},{"@type":"Question","name":"What does TEE attestation actually verify and what are its limitations for securing multi-party computation?","acceptedAnswer":{"@type":"Answer","text":"TEE attestation lets remote parties cryptographically verify what code runs inside the enclave by checking a signed quote containing hashes of code, data, and configuration against a trusted root certificate and known-good measurements. Its limitations include vendor-specific and sometimes incomplete verification checks, measurements that can omit critical components (as happened with WhatsApp Private Inference's LD_PRELOAD vulnerability), and the fact that it cannot prevent host-level attacks like rollback, side-channels, or physical memory interposition. Engineers designing attestation flows for MPC can follow this kind of security analysis on daily.dev."}},{"@type":"Question","name":"What physical attacks have been demonstrated against Intel TDX and AMD SEV-SNP TEEs?","acceptedAnswer":{"@type":"Answer","text":"The TEE Fail attack uses a memory interposition device to physically inspect all DDR5 memory traffic, breaking confidentiality guarantees of Intel TDX and AMD SEV-SNP. The newer DDRop attack goes further, using an interposer costing under $200 to silently drop DDR5 writes so the processor keeps reading stale but validly decrypting data, breaking integrity guarantees of Intel TDX, Scalable SGX, and AMD SEV-SNP alike. Developers evaluating confidential computing hardware can keep up with disclosures like these on daily.dev."}}]} ```