Remote Attestation

Modern Trusted Execution Environments (TEEs) like Intel SGX, AMD SEV-SNP, and Arm CCA extend attestation to the entire virtual machine memory. The hardware generates a hardware-generated attestation report that includes measurements of the enclave's initial code and data.

• SGX DCAP provides flexible, data center-ready attestation
• SEV-SNP includes VM-level integrity and attestation
• Enables zero-trust confidential computing across cloud providers

Shielded 24-byte registers within a Trusted Platform Module (TPM) that store integrity measurements using a cryptographic hash extension operation: PCR[n] = Hash(PCR[n] || NewMeasurement). This append-only design prevents falsification of historical values. During remote attestation, the TPM signs a quote containing the current PCR values, allowing a challenger to verify the exact software state of the platform.

• PCR 0-7: Reserved for platform firmware measurements
• PCR 8-15: Used by the operating system
• PCR 16-23: Available for applications and dynamic roots of trust
• Each PCR can store an unlimited number of measurements through hash extension

A restricted-purpose RSA or ECC key pair generated within the TPM specifically for signing attestation quotes. The AIK's private key never leaves the TPM, ensuring cryptographic binding to that specific hardware instance. To prove the AIK belongs to a genuine TPM without revealing the unique Endorsement Key (EK), a Privacy CA issues an AIK credential after verifying the EK certificate.

• Provides platform anonymity while maintaining hardware authenticity
• Multiple AIKs can be generated for different contexts or privacy domains
• Replaces the deprecated direct use of EK for attestation

The core TPM2_Quote command that produces a cryptographically signed attestation structure containing selected PCR values, a nonce provided by the challenger, and TPM state information. The nonce prevents replay attacks by ensuring each quote is fresh. The signature is generated using the AIK, and the resulting structure can be verified by any party with the AIK's public key.

• TPMS_ATTEST structure includes: PCR selection, PCR digest, nonce, clock info
• Signature algorithm typically TPM_ALG_RSASSA or TPM_ALG_ECDSA
• Verifier must validate signature, nonce freshness, and PCR values against known good measurements

A boot process where each firmware and software component is cryptographically hashed and the measurement is extended into a PCR before control is transferred to that component. Unlike Secure Boot which halts on verification failure, Measured Boot always proceeds but creates an immutable audit log. This log, stored in the Event Log, allows a remote verifier to reconstruct PCR values and identify exactly which components were loaded.

• Static Root of Trust for Measurement (SRTM): Begins with platform reset
• Dynamic Root of Trust for Measurement (DRTM): Can be initiated at any time via CPU instruction
• Event log entries include: PCR index, event type, digest, and component description

A secure area within a main processor that guarantees confidentiality and integrity of code and data loaded inside, isolated from the host OS, hypervisor, and other applications. TEEs like Intel SGX, AMD SEV, and ARM TrustZone provide hardware-backed attestation that proves the exact enclave code and state to a remote party. This extends attestation beyond boot integrity to runtime workload verification.

• Intel SGX: Enclave memory encrypted by Memory Encryption Engine
• AMD SEV-SNP: Full VM memory encryption with attestation report
• ARM CCA: Realm-based confidential computing architecture
• Attestation reports include: measurement, signer identity, TCB version

The Device Identifier Composition Engine (DICE) standard provides lightweight attestation without requiring a discrete TPM. Each boot layer derives a unique Compound Device Identifier (CDI) from the previous layer's secret and the next layer's measurement. If any firmware component changes, the CDI changes, cryptographically proving tampering. DICE enables attestation in resource-constrained devices where a full TPM is impractical.

• Layered boot: ROM → Bootloader → OS → Application
• Each layer receives a unique asymmetric key pair derived from CDI
• Alias keys provide privacy-preserving attestation identities
• Standardized in TCG DICE Architecture Specification