Second @second.tech · May 22

1/ Barkd is what you run when you want to enable bitcoin payments server-side. On a standard cloud VM, the provider, hypervisor, and co-tenants can theoretically read your signing keys from memory. We decided to run some tests to see if TEEs were the solution.

1 likes 1 replies

?

Replies

Second · May 22

2/ Intel SGX was a dead end. AWS Nitro Enclaves worked but needed excessive custom plumbing. Azure's confidential VMs seemed to be the sweet spot. An AMD SEV-SNP runs Barkd unmodified—the CPU encrypts every page of guest memory so the hypervisor only sees ciphertext.