Speaker
Description
Abstract:
This talk is a follow-up of LPC'25, where we introduced the security problem to the community for a suitable approach of attested TLS protocols. We would like to present updates to the work since LPC'25 and discuss open problems with the community so that the feedback can be accommodated in the standardization in the IETF. In particular, we share our discovered critical-severity CVEs, such as CVE-2026-92701, CVE-2026-92702, CVE-2026-100835, each of CVSS 9.1, and other critical- and high-severity security concerns against early attestation, and ask the community whether early attestation is really necessary.
Discussion:
We would like to discuss:
Background:
Transport Layer Security (TLS) is a widely used protocol for secure channel establishment. However, it lacks an inherent mechanism for validating the security state of the workload and its platform. To address this, remote attestation can be integrated into TLS, which is named attested TLS protocol.
As presented in LPC'25, there are two key approaches for this integration, namely early (intra-handshake) and standard (post-handshake) attestation. We also present insights from formal verification using the state-of-the-art symbolic security analysis tool ProVerif that led to the discovery of the critical- and high-severity CVEs in early attestation.
Current project partners include CoreWeave, University of Namur, Stevens Institute of Technology, Shanghai Guan An Information Technology, Switch, Oxford University, Sureshot Labs, PHI-OMEGA, HashCloak Inc, Stoffel Labs Inc, EMILIA Protocol, ESILV, Birmingham City University, Verily, Arm, Linaro, Siemens, Huawei, Intuit, Axis, Bonn-Rhein-Sieg University of Applied Sciences, and Barkhausen Institut. By this talk, we hope to inspire more open-source contributors to this project.
The attendees will gain technical insights into the latest developments of standardization of attested TLS protocols in the IETF, and will be able to provide feedback on the standardization effort of attested TLS.
Benefits to the ecosystem
Our thorough formal security analysis shows that early attestation is potentially vulnerable to replay, relay, diversion, and misbinding attacks. Our analysis shows that:
- Early attestation adds unnecessary complexity in the handshake.
- Early attestation results in several security and privacy problems, such as those captured in published CVEs.
- All use cases of early attestation can be handled with standard attestation while offering better security properties.
Because of critical-severity CVEs and fundamental architecture problems in early attestation, we believe early attestation is very harmful to the TEE attestation ecosystem. We would like to discuss with the community whether it is necessary.