attestation
/ at-ess-TAY-shun /
Confidential computing lets code run protected inside an enclave on a machine you do not control. But that raises an immediate question: before you send your secret to that remote enclave, how do you know it really is a genuine enclave running exactly the code you expect, and not an impostor pretending to be one to harvest your data? Attestation is the answer - a hardware-backed way for a remote party to prove what code is actually running inside a protected environment before any secret is entrusted to it.
Concretely, attestation works through a signed report rooted in the CPU hardware. The processor measures the enclave - it computes a cryptographic hash of the initial code and configuration loaded into the protected region - and produces a report containing that measurement, signed by a key that ultimately chains back to the hardware vendor and cannot be forged by software. A remote verifier receives this report, checks the signature to confirm it came from genuine hardware, and compares the measurement against the hash of the exact code it expects. Only if everything matches does the verifier proceed - for example, releasing a secret key into the enclave. The flow is: I, the relying party, challenge the enclave; the hardware returns a signed measurement; I verify the signature and the measurement; then and only then do I trust it with my data.
It matters because attestation is what turns an enclave from 'a box that claims to be secure' into 'a box I can verify is running the code I audited' - without it, confidential computing would be unfalsifiable trust. But be honest about what it establishes. Attestation proves the identity of the loaded code and that genuine hardware is running it; it does not prove that code is bug-free, well-behaved, or free of vulnerabilities - you are trusting that the specific measured code is trustworthy, which you must establish separately by review. And the whole chain rests on trusting the hardware vendor's signing keys and attestation service; if that root is compromised, the proof is worthless. Attestation verifies what is running, not that what is running is safe.
1. verifier -> enclave: prove what you are running 2. CPU hashes (measures) the enclave's code, signs it with a hardware key 3. enclave -> verifier: signed report { measurement = hash(code), signature } 4. verifier checks signature came from genuine HW AND hash == the code I audited -> only then release the secret. (Proves WHICH code runs, NOT that it is bug-free.)
Attestation: the hardware signs a measurement of the enclave's code; the verifier checks both the signature and the hash before trusting it with a secret.
Attestation proves the identity of the loaded code and that genuine hardware runs it - not that the code is correct, safe, or vulnerability-free; that you must establish by reviewing the measured code. The whole chain also rests on trusting the hardware vendor's keys, so a compromised root makes the proof meaningless.