DCAP

DCAP introduces the ECDSA (Elliptic Curve Digital Signature Algorithm) Attestation model, replacing the anonymous EPID scheme. This allows a relying party to verify an enclave's Quote directly using a chain of X.509 certificates rooted in the Intel SGX Root CA. Key verification steps include:

• Validating the MRENCLAVE and MRSIGNER measurements
• Checking the TCB Status against the latest security advisories
• Confirming the Quote signature using the Provisioning Certification Key

The cryptographic protocol that DCAP facilitates, enabling a Trusted Execution Environment (TEE) on one machine to prove its identity and software integrity to a remote verifier. DCAP provides the Provisioning Certification Service infrastructure that replaces Intel's cloud-hosted attestation, allowing data centers to verify SGX and TDX enclaves locally. The verifier checks the enclave measurement against a known-good reference value to establish trust before provisioning secrets.

A critical DCAP component that delivers collateral required for attesting Intel platforms. The PCS provides:

• PCK Certificates: Platform-specific keys for the Quoting Enclave
• TCB Info: Trusted Computing Base recovery information
• QE Identity: Quoting Enclave identity data
• CRL: Certificate Revocation Lists

DCAP allows organizations to cache this collateral locally, enabling offline attestation without runtime dependency on Intel's cloud services.

The foundational hardware-based TEE that DCAP was originally designed to attest. Intel SGX creates enclaves—hardware-isolated memory regions that protect code and data from the OS, hypervisor, and other applications. DCAP verifies SGX enclaves by checking the MRENCLAVE and MRSIGNER measurements against the Provisioning Certification Service's reference data, ensuring the enclave hasn't been tampered with before provisioning sensitive workloads.

Intel Trust Domain Extensions extend Confidential Computing to entire virtual machines. Unlike SGX's application-level enclaves, TDX creates a hardware-isolated Confidential VM where the entire guest OS and workload are protected from the hypervisor. DCAP supports TDX attestation by providing the infrastructure to verify TDX module measurements and trust domain integrity, enabling lift-and-shift migration of legacy applications into confidential environments without code changes.

The attestation workflow that DCAP enables:

1. Quote Generation: The platform's Quoting Enclave (QE) produces a signed report containing the enclave's measurement and platform TCB status
2. Collateral Retrieval: The verifier fetches PCK certificates and TCB info from the local PCS cache
3. Signature Verification: The verifier validates the quote's ECDSA signature against the PCK certificate chain
4. TCB Evaluation: The verifier checks that the platform's firmware and microcode versions meet the required security baseline

The application of Confidential Computing hardware—attested by DCAP—to protect ML workloads. DCAP enables verifiable Private Inference by attesting that:

• The model weights remain encrypted until inside a genuine TEE
• The inference runtime hasn't been tampered with
• The client's input data is only decrypted within the attested enclave

This creates a mutually confidential channel where neither the model provider nor the data owner exposes their assets to the other party or the cloud operator.