ENCLAVE-06: Enclave attestation document is nonce-bound and timestamped¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | attest |
| Assurance | report-derived |
| Mode | Passive: reads only the files and values you pass to the scan. |
What it checks¶
Example failures:
- Attestation document is not replay-bound: attestation document carries no nonce (no replay binding).
How to fix¶
- Have the relying party issue a fresh random nonce per attestation request, pass it to the enclave's NSM GetAttestationDocument call, and reject any document whose nonce differs or whose timestamp is stale. Supply --nitro-nonce to verify the echoed challenge.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No --nitro-attestation-doc specified; skipping check.
ERROR:
- Could not read a valid COSE_Sign1 attestation document.
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--nitro-attestation-doc |
Path to a captured COSE_Sign1 attestation document (ENCLAVE-06). |
--nitro-nonce |
Hex verifier nonce the attestation document should echo (ENCLAVE-06). |
Permissions¶
None. The check reads only the files or values you pass to the scan.
Evidence recorded¶
Keys in the finding's evidence: has_nonce, issues, nonce, nonce_matches_expected, passed, timestamp
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).