Properties and Use Cases for Integrating Remote Attestation with Secure Channel Protocols

1.1. Establishing Trust in Secure Communications

Secure channel protocols, such as Transport Layer Security (TLS), primarily establish trust in a peer's identity. This is typically achieved through mechanisms like a Public Key Infrastructure (PKI), where a trusted Certification Authority (CA) vouches for the binding between a public key and an identifier (e.g., a hostname).¶

However, this model has one key limitation: entity authentication provides no assurance about the peer's state, such as the integrity of its software stack at boot time and during runtime. A compromised endpoint, for instance, can still present a valid X.509 certificate and be considered "trusted" by a client. This gap allows compromised endpoints to maintain network access and the trust of their peers, posing a significant security risk in many environments.¶

1.2. The Role of Remote Attestation

Remote Attestation (RA), as described in the RATS architecture [RFC9334], is a mechanism designed to fill this gap. RA allows an entity (the "Attester") to produce verifiable "Evidence" about its current runtime state. This Evidence covers the Attester's TCB and can thus include measurements of:¶

• firmware¶

• operating system¶

• application code¶

• the configuration of its hardware and software security features (e.g., secure boot status and memory isolation).¶

A "Relying Party" can then use this Evidence, often with the help of a trusted "Verifier", to appraise the Attester's trustworthiness.¶

Composing RA with a secure channel establishment protocol adds a second dimension of trust - trustworthiness - to complement peer authentication. This allows a peer to make authorization decisions based not just on who the other party is, but also on what it is (e.g., an AMD SEV-SNP-based server running in some known datacenter) and whether its state is acceptable.¶

1.3. Purpose and Scope

The purpose of this document is to establish a set of essential properties for composition of RA with secure channel protocols and to outline the key use cases that can benefit from such a composition. Most of the use cases presented in this document are provided by industry contributors in the SEAT WG, who have plans to deploy this technology. The initial focus is on TLS 1.3 [I-D.ietf-tls-rfc8446bis] and its datagram-oriented variant, DTLS 1.3 [I-D.ietf-tls-rfc9147bis].¶

This document is intended as an input to the design of protocol solutions within the SEAT working group. It defines the "why" (the motivation) and the "what" (the requirements), but not the "how" (the protocol design itself). The "how" part is discussed in the companion document [I-D.usama-seat-intra-vs-post], which serves as the glue between this document and the protocol specifications. A key goal of this document is to define requirements for a solution that is agnostic to any specific attestation technology (e.g., Trusted Platform Modules (TPMs), Intel TDX, AMD SEV, Arm CCA).¶

3.1. Cryptographic Binding to Communication Channel

The Evidence or Attestation Result is cryptographically bound to the specific secure connection (e.g., the (D)TLS connection). This prevents relay attacks where an attacker presents valid, but unrelated Evidence from a different connection or context. This binding is paramount for all use cases because the absence of this binding can be exploited in high-severity vulnerabilities, such as [CVE-2026-33697].¶

3.2. Compound Authentication

RA should complement endpoint authentication rather than replace it. Combining the two security measures would ensure that the introduction of attestation increases security instead of replacing one security measure by another. A formal representation of this requirement in the form of composition goal can be found in [ID-Crisis] for TLS 1.3 protocol.¶

3.3. Cryptographic Binding to Machine Identifier

Evidence should be cryptographically bound to the identifier provided to the machine by the infrastructure provider to prevent diversion attacks [ID-Crisis].¶

3.4. Attestation Credential Freshness

The Relying Party is able to verify that the Evidence or Attestation Result it receives was freshly generated by the Attester for the specific RA interaction. State is transient, and credentials from a previous RA interaction may no longer be valid. See Section 10 of [RFC9334] for more details about freshness in the context of RA. This is formalized for attestation nonce in [ID-Crisis].¶

3.5. Negotiation and Capability Discovery

Peers have a secure mechanism to discover each other's support for RA, the specific attestation formats they can produce or consume, and the attestation models they support. This enables interoperability and allows for graceful fallback for endpoints that do not support RA.¶

3.6. Attestation Model Flexibility

The solution supports both the Background Check and Passport models as defined in the RATS architecture [RFC9334]. The Background Check model is essential for use cases requiring maximum freshness, while the Passport model is better suited for performance, scalability, and scenarios where the Verifier may be offline or unreachable by the Relying Party.¶

3.7. Interaction with Peer Authentication

The solution supports using RA in conjunction with traditional PKI-based authentication (e.g., X.509 certificates). This provides two independent pillars of trust: endpoint trustworthiness (from RA) and identity (from PKI).¶

3.8. Runtime Attestation

Evidence collected at certificate issuance or during the initial secure channel establishment reflects only the Target Environment’s state at that moment. It cannot guarantee that the Target Environment remains trustworthy for the lifetime of the certificate or even for the duration of the secure connection (e.g., the (D)TLS connection). As a result, such static Evidence is insufficient in environments where the Target Environment may change state after the connection is established and the connection is long-lived.¶

3.9. Privacy Preservation

The solution must not degrade the privacy of a standard secure connection (e.g., the (D)TLS connection). Evidence can contain highly specific, unique information about a device's hardware and software, which could be used as an advanced tracking mechanism, following a user across different connections and services. The design must consider how to minimize this leakage, especially when a third-party Verifier is involved in the protocol exchange.¶

3.10. Performance and Efficiency

The introduction of remote attestation should not add prohibitive latency or overhead to the connection establishment process. To be widely adopted, the solution must be practical. While some overhead is unavoidable, multiple additional round-trips or very large payloads in the initial handshake should be minimized.¶

4.1. Secure Provisioning and High-Assurance Operations

Goal: Ensure the integrity of workloads and devices when bootstrapping their PKI-based identity or receiving critical commands.¶

4.2. Confidential Data Collaboration

Goal: Enable multiple parties to collaborate on sensitive, combined datasets without exposing raw data to each other or to the infrastructure operator.¶

4.3. Network Infrastructure Integrity

Goal: Verify the integrity of network devices that form the foundation of communication.¶

4.4. Operation-Triggered Attestation for High-Impact Application Operations

Goal: Ensure the integrity of application services at operation time, when security posture may change after initial channel establishment.¶

Use case: High-Assurance Operation Execution in Dynamic Application Services: An application service instance (e.g., AI agent) or confidential computing environment (which could host an AI agent) maintains a (D)TLS connection with a peer and must execute a high-impact action (e.g., payment initiation, configuration change, privileged command).¶

• Requirement 1: Before executing a high-impact operation over the existing connection, the peer must present fresh, connection-bound Evidence reflecting the current behavior-affecting posture (e.g., enabled capabilities, policy configuration, runtime permissions).¶

• Requirement 2: The mechanism should support lightweight, dynamic attestation within the existing connection, without necessarily requiring a full new TLS handshake, so that behavior-affecting posture changes are visible to relying parties when required by local policy.¶

4.5. Attestation of Certificate Private Key

A TLS endpoint authenticates itself using an end-entity certificate whose corresponding private key is claimed to be protected by a secure element. While standard TLS authentication verifies possession of the private key, it provides no assurance about where or how that key is stored and used.¶

In this scenario, the peer acting as the Relying Party requires additional assurance that the private key associated with the end-entity certificate used to authenticate the TLS connection is generated, stored, and used within an attested cryptographic module. In addition to verifying possession of the private key via the TLS handshake, the Relying Party seeks Evidence that the key is non-exportable, remains bound to the cryptographic module, and that the module is operating in an expected security configuration at the time the TLS connection is established.¶

Remote attestation is used to provide Evidence about the cryptographic module where the private key used for TLS authentication is stored. The Evidence may include claims about the security properties of the cryptographic module. To prevent replay attacks, this Evidence has to be fresh and tied to the current TLS connection. Replayed Evidence could otherwise be used to falsely assert key protection properties that no longer hold.¶

• Requirement: The Attester must be able to produce Evidence that demonstrates that the private key used for secure channel authentication:¶

  • is generated and stored within a specific cryptographic module or secure element,¶

  • is protected against export or software extraction¶

  • is attested using fresh Evidence that is bound to the current TLS connection.¶

The Relying Party uses this Evidence, potentially with the assistance of a Verifier, to determine whether the key protection properties satisfy its local security policy.¶

The approach described in [I-D.draft-ietf-rats-pkix-key-attestation] addresses this use case partially by providing attestation of the cryptographic module and associated private key at certificate issuance time, reflecting their state when the certificate is enrolled. This model does not provide guarantees about the continued state of the module at connection establishment or during the lifetime of the TLS connection.¶

4.6. Platform-to-platform communication

Goal: Allow platforms to establish a trustworthy secure channel with each other.¶

Use case: Migration of workloads (confidential workloads in particular) between different platforms. Migration is occasionally required in order to maintain uptime for the hosted services across periods of scheduled downtime for the hosting platform. Having remote attestation-enforced policies for such migration events provides guarantees that the services will not be exposed to lower security guarantees when migrating. Migration is typically performed by trusted, low-level components (migration agents) on both source and destination platforms, which perform the authorization checks and handle the data migration.¶

• Requirement: The migration agent on the destination platform typically acts as Attester, proving its state for its peer on the source platform (where the workload initially resides).¶

• Example: Intel TDX offers migration capabilities via its Migration Trust Domain (MigTD) [MigTD]. Peer MigTDs on the initiating and target platforms set up an attested TLS connection to perform the migration over.¶

4.7. AI Governance and Accountability

Goal: Design framework for governing autonomous AI agents.¶

Use case: See [I-D.aylward-aiga-2] for details. Contrary to Section 4.4, the entity verifying the Evidence in this case is the governance body and for the purposes of ensuring that no unethical or harmful action is performed.¶

• Requirement: Runtime attestation based on agent risk tiers defined in Section 2.2 of [I-D.aylward-aiga-2]¶