TrustMee: Self-Verifying Remote Attestation Evidence

Abstract

Remote attestation allows a TEE to attest its own state to a remote party, and is used in the Confidential Computing ecosystem to provide assurance that data and code are available only to authorized hardware and software. This functionality can then be incorporated into higher-level platforms, allowing workloads to attest themselves to a remote party. However, supporting each new platform enlarges a Verifier's trusted computing base, since it must include code to verify the attestation evidence from each platform, often performing risky operations e.g., binary parsing. This means that emerging or niche Attester platforms cannot be supported by standard Verifier software, preventing them from interacting with the broader confidential computing ecosystem. We introduce self-verifying remote attestation evidence. Each attestation bundle identifies its verification logic in the form of a WebAssembly component that is downloaded by the Verifier and executed. This approach transforms evidence verification into a platform-agnostic functionality that is implemented once for all platforms: the Verifier executes the supplied verification logic to validate the evidence and incorporates its hash and, when available, the signer's public key as identity claims into the attestation result. As a result, Verifiers can validate attestation evidence without any platform-specific code; the verification logic is just another measurement whose reference value can be checked with existing mechanisms. We implement this concept as TrustMee, a platform-agnostic verification driver for the Trustee framework. We demonstrate self-verifying evidence for AMD SNP, Intel TDX, Intel SGX, Kata agent-policy appraisal, and ReCFA control-flow attestations, producing attestation claims in the standard EAT format. The last two are part of the software stack, and not supported by existing Verifiers such as Trustee.

16 pages, 7 figures