The Trust Problem
Suppose you are Hospital A. You've been told that a Nitro Enclave is running on some AWS server, and it's safe to send your encrypted patient data there. But how do you know that? How do you know the enclave is running the exact code you audited, and not a modified version that secretly exfiltrates data?
Remote Attestation is the answer. It is a cryptographic protocol that lets a remote party (you) verify two things about an enclave:
- Hardware Authenticity: This is a genuine TEE running on real hardware from a trusted manufacturer (Intel, AMD, or AWS).
- Code Integrity: The exact code running inside the enclave matches a known, audited version — not a modified or malicious version.
How Remote Attestation Works (Step by Step)
-
Measurement at Load Time: When the enclave is initialized, the hardware computes a cryptographic hash (a measurement) of every page of code and data loaded into the enclave. This hash is stored in a protected hardware register.
-
Attestation Request: You (the verifier) send a challenge — typically a random nonce — to the enclave.
-
Signed Report: The enclave asks the CPU to produce an Attestation Document. This document contains:
- The enclave's measurement (code hash).
- The nonce you sent (proving freshness — this is not a replay).
- Platform information (CPU model, firmware version).
- A public key generated inside the enclave.
The CPU signs this document using a private key burned into the silicon by the manufacturer. For AWS Nitro, this is the Nitro Security Module's key, whose certificate chain roots back to AWS.
- Verification: You receive the Attestation Document and:
- Verify the signature against the manufacturer's public certificate (obtained from Intel/AMD/AWS's certificate authority).
- Check that the measurement matches the hash of the code you audited.
-
Check that the nonce matches what you sent.
-
Secret Delivery: Only after all checks pass do you release your secrets (or instruct KMS to release the decryption key) to the enclave.
The guarantee: If the code inside the enclave were modified by even a single byte, the measurement would change, the hash would not match, and you would refuse to send your secrets.
A common interview question is: "What prevents an attacker from replaying a valid attestation report?" The answer is the nonce (number used once). The verifier generates a fresh random nonce and includes it in the challenge. The attestation report must contain that exact nonce, signed by the hardware. Since the nonce is random and single-use, a replayed old report will have the wrong nonce and be rejected. This is a standard challenge-response pattern applied to hardware attestation.