KBS-01: CoCo KBS releases keys only against a verified attestation¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | AWS Nitro Enclaves |
| Lifecycle stage | attest |
| Policy | P-03: Key release requires an attested measurement |
| Mode | Passive: reads only the files and values you pass to the scan. |
How to fix¶
- Configure the key broker so a secret is released only after it verifies the enclave's attestation (measurement and signer), and deny requests that present no attestation evidence.
After the fix, scan again: the check should report PASS.
Permissions¶
None. The check reads only the files or values you pass to the scan.
Related¶
- Runtime detection
DET-K1(Key broker (KBS)): Key released without a bound measurement - Runtime detection
DET-K2(Key broker (KBS)): Key released against a debug or all-zero measurement - Other checks for policy P-03: CSPACE-KEYBIND-01, CSPACE-KEYBIND-03, CSPACE-KMS-01, CSPACE-KMS-02, GPUCC-BIND-01, GPUCC-DECRYPT-01, GPUCC-KEY-01, HSM-01, KMS-01, VAULT-01
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).