Intel to end SGX support after Xeon Diamond Rapids, shifts focus to TDX
Intel plans to discontinue Software Guard Extensions after the next Xeon generation, prioritizing Trust Domain Extensions for cloud and AI workloads.
Key points
- Intel will stop adding SGX to new CPUs after the Xeon Diamond Rapids generation.
- The company will maintain support for existing SGX hardware into the early 2030s.
- Trust Domain Extensions will become the primary focus for future confidential computing.
Intel announced on Friday that it will discontinue support for its Software Guard Extensions (SGX) technology after the upcoming Xeon Diamond Rapids processor generation. The chipmaker will shift its confidential computing development resources toward Trust Domain Extensions (TDX) to address evolving security needs in cloud environments.
According to Tom's Hardware, Intel will continue supporting existing platforms that use SGX well into the early 2030s. The company intends to expand TDX capabilities to handle emerging requirements for enterprise workloads and agentic AI applications. This transition allows customers time to migrate away from the older enclave-based technology.
Technical differences and industry shift
SGX and TDX both protect sensitive data during processing but use different isolation methods. SGX creates hardware-protected enclaves inside applications to isolate specific code and data from the operating system and hypervisor. In contrast, TDX isolates entire virtual machines from the underlying host environment, including other VMs and the hypervisor itself.
Developers using SGX must modify their applications to utilize these protected enclaves. TDX allows existing workloads to run inside confidential virtual machines without requiring extensive changes to individual applications. According to Intel, this makes TDX particularly attractive for cloud service providers managing large numbers of virtual machines.
Intel states that its decision reflects the industry preference for virtual machine-level isolation over application-specific enclaves. The company believes TDX offers better scalability and ease of deployment for widespread confidential computing adoption. Intel does not cite security vulnerabilities as the reason for phasing out SGX, despite both technologies having faced side-channel and privilege-escalation flaws in the past.
Impact on enterprises and cloud providers
Xeon Diamond Rapids will be the final Intel Xeon generation to support SGX. This provides organizations with several years to validate alternative solutions based on TDX and migrate their current applications. Intel notes that SGX continues to serve security-conscious customers and enabled early confidential computing in data centers.
The shift aims to meet growing data sovereignty requirements as organizations seek to protect sensitive information from unauthorized access. This protection is crucial even when data is processed on infrastructure operated by third parties. Cloud service providers can leverage TDX to offer confidential computing without forcing clients to rewrite their software stacks.
Intel expects future demand to favor the operational model provided by TDX. The company is concentrating its efforts on expanding TDX to address the specific security requirements of modern cloud computing and AI-driven workloads. Existing SGX users will have continued support, but new deployments should consider the long-term viability of TDX.
What should you do?
Security and IT leaders should assess their current use of Intel SGX in production environments. Evaluate whether critical workloads can be migrated to TDX-enabled virtual machines in the coming years. Monitor Intel’s release notes for TDX capability expansions relevant to your specific cloud or enterprise workload.
What to do and how to stay safe: Intel
- Audit current infrastructure to identify applications relying on Intel SGX enclaves for data protection.
- Test migration paths for sensitive workloads from SGX to TDX confidential virtual machines.
- Review vendor documentation to understand the support timeline for existing SGX hardware.
- Consult with cloud service providers about their TDX adoption roadmap and availability.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When will Intel stop supporting SGX?
Intel will discontinue adding SGX support after the Xeon Diamond Rapids generation, but will support existing hardware into the early 2030s.
Why is Intel switching from SGX to TDX?
Intel cites industry preference for VM-level isolation and the scalability benefits of TDX for cloud and AI workloads, rather than security flaws.
Does TDX require code changes?
No, TDX protects existing workloads inside confidential VMs without extensive application changes, unlike SGX which requires enclave design.
