On Wed, 2023-04-26 at 13:32 +0000, Reshetova, Elena wrote: > > On Mon, Mar 27, 2023, Carlos Bilbao wrote: [...] > > > +provide stronger security guarantees to their clients (usually > > > referred to +as tenants) by excluding all the CSP's > > > infrastructure and SW out of the +tenant's Trusted Computing Base > > > (TCB). > > > > This is inaccurate, the provider may still have software and/or > > hardware in the TCB. > > Well, this is the end goal where we want to be, the practical > deployment can differ of course. We can rephrase that it "allows to > exclude all the CSP's infrastructure and SW out of tenant's TCB." That's getting even more inaccurate. To run in a Cloud with CoCo you usually have to insert some provided code, like OVMF and, for AMD, the SVSM. These are often customized by the CSP to suit the cloud infrastructure, so you're running their code. The goal, I think, is to make sure you only run code you trust (some of which may come from the CSP) in your TCB, which is very different from the statement above. James
