Standardization and Open-source Implementation of Attested TLS for Confidential Computing#

Muhammad Usama Sardar (TU Dresden), peg (Peg Jones, Flashbots)

• Why: Attested TLS is becoming the identity primitive of confidential computing, and it's being standardized right now in the new IETF SEAT WG. This talk comes from the people driving it, with formal proofs of why the obvious designs are broken.
• What: A taxonomy of attested TLS — pre-handshake, intra-handshake, post-handshake attestation — plus formal-analysis results: replay attacks on pre-handshake attestation (including Intel's RA-TLS), diversion and relay attacks on intra-handshake designs (one shown to break Cocos AI), leading to a post-handshake candidate draft built on exported authenticators (RFC 9261) with a cmw_attestation extension carrying RATS evidence in the Certificate message.
• How: The WiP implementation is Rustls-based, transport-agnostic (QUIC included, tested with Intel TDX), supports one-way and mutual attestation, and supports both the RATS "passport" and "background check" models. Notable engineering friction: Rustls deliberately doesn't expose handshake internals, and there's essentially one partial open-source reference for exported authenticators — so they implemented it from scratch.
• Where applicable: Server-to-server attested channels where you control both ends (Flashbots uses a similar protocol for TEE-based Ethereum block building), and proxies that terminate attestation for naive clients. Explicitly not yet: browsers (APIs don't expose TLS keying material) or paths through TLS-terminating proxies — many deployments paper over this with nested encryption.