DET-K2: Key released against a debug or all-zero measurement¶
A key broker released a secret against an all-zero / debug measurement: the receiving TEE was not in a verified production state.
| Property | Value |
|---|---|
| Severity | high |
| Platform | Key broker (KBS) |
| Group | tee |
| Log source | KBS · release event |
| Policy | P-03 |
| Related check | KBS-01: CoCo KBS releases keys only against a verified attestation |
Fires when¶
verdict == released AND the bound measurement is all-zero / debug
How it runs¶
untrust detect --platform kbs reads exported key-broker release events from --kbs-log-file.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.