Source-linked AI summary
Integrating Remote Attestation with Transport Layer Security
Thomas Knauth, Michael Steiner, Somnath Chakrabarti, Li Lei, Cedric Xing, Mona Vij
TL;DR
A shared secret alone does not efficiently provide a standard secure channel. RA-TLS integrates Intel SGX remote attestation into TLS through certificate evidence, without changing the TLS protocol or existing libraries; the paper reports prototypes for OpenSSL, wolfSSL, and mbedTLS.
Problem
A shared secret only partially solves secure communication, while separately bootstrapping a channel duplicates work; the goal is to integrate attestation with a standard secure channel.
Source: p. 1Method
RA-TLS embeds attestation evidence in the X.509 certificate and integrates remote attestation into standard TLS without modifying existing TLS libraries.
Source: p. 3Results
The proposed scheme leaves TLS unchanged and has prototypes for OpenSSL, wolfSSL, and mbedTLS.
Source: p. 1Takeaways & Limitations
A library encapsulates attestation and verification behind a simple API, simplifying practical use of remote attestation.
Source: p. 11The explanation focuses on the classic client/server scenario, although the scheme also covers mutual authentication and attestation.
Source: p. 5
Abstract
from arXiv · showhide
Intel(R) Software Guard Extensions (Intel(R) SGX) is a promising technology to securely process information in otherwise untrusted environments. An important aspect of Intel SGX is the ability to perform remote attestation to assess the endpoint's trustworthiness. Ultimately, remote attestation will result in an attested secure channel to provision secrets to the enclave. We seamlessly combine Intel SGX remote attestation with the establishment of a standard Transport Layer Security (TLS) connection. Remote attestation is performed during the connection setup. To achieve this, we neither change the TLS protocol, nor do we modify existing protocol implementations. We have prototype implementations for three widely used open-source TLS libraries: OpenSSL, wolfSSL and mbedTLS. We describe the requirements, design and implementation details to seamlessly bind attested TLS endpoints to Intel SGX enclaves.