🛡️ Using TDX (Experimental)

⚠️ EXPERIMENTAL FEATURE

TDX support is currently experimental and should NOT be used in production. This feature is provided for testing and development purposes only. Expect instabilities, limited compatibility, and potential outages.

Intel TDX (Trust Domain Extensions) is the next generation of TEE technology. This guide shows you how to enable TDX in your iApp and understand the differences from the default SGX implementation.

What is TDX?

TDX (Trust Domain Extensions) is Intel's newer confidential computing technology, different from the default SGX implementation.

SGX vs TDX Differences

SGX (Current Default):

• ✅ Production ready and stable
• ✅ Widely supported by iExec workers
• ❌ Memory limitations in TEE environment

TDX (Experimental):

• ✅ Potentially better for memory-intensive workloads
• ❌ Experimental and unstable
• ❌ Limited worker availability
• ❌ Not production ready

Feature	Intel SGX	Intel TDX
Release Year	2015	2023
Enclave Scope	Application level	Virtual machine level
Code Adaptation Required	Yes - needs redesign of app's logic	No - supports lift-and-shift of full systems
Memory Size	Limited	Extensive (multi-GB+)
Integration Complexity	Higher (more dev work)	Lower (VM legacy code)
Best Fit For	Lightweight, high-assurance modules (e.g. wallets, crypto key ops, small AI models)	Heavier AI workloads, legacy apps, databases

Enabling TDX in iApp Generator

Environment Variable Method

Enable TDX for deployment and execution:

# Set the experimental flag
export EXPERIMENTAL_TDX_APP=true

# Deploy and run with TDX
iapp deploy
iapp run <app-address>

Environment Variable Declaration

The syntax for setting environment variables differs between operating systems:

• Mac/Linux: export EXPERIMENTAL_TDX_APP=true
• Windows: set EXPERIMENTAL_TDX_APP=true

Per-Command Method

Enable TDX for specific commands:

# Deploy TDX-enabled iApp
EXPERIMENTAL_TDX_APP=true iapp deploy

# Run with TDX
EXPERIMENTAL_TDX_APP=true iapp run <app-address>

# Debug TDX execution
EXPERIMENTAL_TDX_APP=true iapp debug <taskId>

Verification

Check if TDX is enabled:

# Your deployed iApp should show TDX-related tags
iexec app show <app-address>

⚠️ To use the iExec DataProtector SDK with TDX support, you must configure the SDK with the right SMS endpoint.

const dataProtector = new IExecDataProtector(web3Provider, {
  iexecOptions: {
    smsURL: 'https://sms.labs.iex.ec',
  },
});

⚠️You need to change the default worker pool in your protected Data declaration

await dataProtector.core.processProtectedData({
  protectedData: protectedData.address,
  workerpool: 'tdx-labs.pools.iexec.eth',
  app: '0x1919ceb0c6e60f3B497936308B58F9a6aDf071eC',
});

Protected Data Compatibility

Protected Data Requirements

TDX iApp may require TDX-compatible protected data. Check compatibility before using protected data with TDX iApp.

Important: The exact process for creating TDX-compatible protected data may differ from standard protected data creation. Consult the latest DataProtector documentation for TDX-specific requirements.

Development Workflow

1. Local Testing

# Test locally (same as regular iApp)
iapp test --protectedData "mock_name"

# TDX only affects remote deployment/execution

2. Deployment

# Deploy TDX iApp
EXPERIMENTAL_TDX_APP=true iapp deploy

3. Execution

# Run with TDX
EXPERIMENTAL_TDX_APP=true iapp run <app-address>

Current Limitations

Production Warnings

• 🚫 NOT for production use
• 🚫 Limited worker availability
• 🚫 Unstable execution environment
• 🚫 Breaking changes without notice

When to Use TDX

Consider TDX only for:

• 🔬 Research/development purposes
• 🧪 Testing future capabilities

Use SGX for:

• 🚀 All production applications
• ⚡ Reliable execution requirements

What's Next?

For production applications, use the standard SGX guides:

• Debugging Your iApp - Troubleshoot execution issues
• Inputs and Outputs - Handle data in TEE environment
• App Access Control and Pricing - Deploy production-ready iApp