5

Enclaves & attestation today — the core

goal: master Amazon Nitro's registers and place every other chip on one map
objective This is where "PCR0 for enclaves" lives. Build a protected enclave, read its signed evidence field by field, and release a real secret only to an enclave with the expected fingerprints. An enclave is a sealed-off, encrypted compartment of a computer that even the machine's owner cannot peek into.
Amazon Web Services — Nitro Enclave fingerprints (all use SHA-384) PCR0the enclave image — YOUR code & its environmentthe anchor PCR1the operating-system kernel + startup PCR2your application code specifically PCR3the parent machine's identity role PCR4the exact parent machine's ID number PCR8the certificate that signed your enclave (who built it) ⚠ a "debug" enclave reports ALL registers as zero — never trust that
SHA-384 = Secure Hash Algorithm producing a 384-bit fingerprint. Notice the same idea as Phase 4: PCR0 = your code's identity, PCR8 = who signed it. If you can reproduce your build bit-for-bit, anyone can re-compute PCR0 and confirm you're running exactly the published code — without trusting you.
The Attestation Document (the enclave's signed "here is what I am") • which module signed it, and a timestamp • the register values (PCR0…PCR8) • the certificate + chain up to Amazon's root • a public key to encrypt replies to • optional caller data • the checker's nonce (proves it's live) signed by hardwareNitro Security Module format: CBOR + COSEcompact binary, signedverify to Amazon's root
NSM = Nitro Security Module, the hardware that produces and signs this. CBOR/COSE as defined in Phase 1. This document is the "Quote" from the core loop, in Amazon's specific shape.
Enclavewants a secret key Key Service(Amazon KMS) Policy checkdoes PCR0 matchthe expected value? sends itssigned document key released — but only if fingerprints match "Give the key ONLY to an enclave running the right code"
This is the pattern you'll actually build for enclave-based key custody. KMS = Key Management Service. The exact rule name is kms:RecipientAttestation:PCR0 — note the prefix is kms:, a detail people very commonly get wrong as aws:. The key comes back encrypted to the enclave's own public key, so only that enclave can use it.
Same four ideas, five different chips — this is what makes you fluent everywhere the concept ↓ Amazon Nitro Intel SGX Intel TDX AMD SEV-SNP Arm CCA code identity PCR0 MRENCLAVE MRTD MEASUREMENT RIM who signed it PCR8 MRSIGNER — ID_KEY_DIGEST token runtime registers yes no RTMR0–3 via vTPM REM0–3 freshness field nonce REPORTDATA REPORTDATA REPORT_DATA challenge trust root Amazon Intel Intel AMD Arm/maker
The acronyms, spelled out: SGX = Software Guard Extensions; TDX = Trust Domain Extensions; SEV-SNP = Secure Encrypted Virtualization–Secure Nested Paging; CCA = Confidential Compute Architecture. MRENCLAVE/MRTD/MEASUREMENT/RIM are each just that platform's word for "PCR0" — the fingerprint of the code. vTPM = a virtual (software) version of the security chip, running inside the protected VM.
the details experts catch
  • The rule prefix is kms:RecipientAttestation, not aws:RecipientAttestation. It gates five operations, including one called DeriveSharedSecret.
  • Debug enclaves report all-zero registers — a verification that "passes" against zeros is a false pass.
  • PCR3 and PCR4 hash PADDED input: SHA-384 over the value padded with 48 zero bytes. Hash the bare role ARN or instance ID and nothing will match — with no error to tell you why.
lab 5 · the core build (do all of it)
  • Launch a Nitro-capable Amazon machine; build a small enclave with nitro-cli build-enclave; record PCR0/1/2. Sign it and watch PCR8 appear.
  • From inside, request the attestation document; ship it out and parse it yourself — verify the signature to Amazon's root, check your nonce, read the registers.
  • Create a key whose policy requires kms:RecipientAttestation:PCR0 = your value; decrypt from inside the enclave; then flip one byte of the expected value and watch it be denied.
  • Rebuild the enclave on a clean machine and confirm you get the identical PCR0 — that's reproducibility, the whole trust story.
mastery gate 5

From memory: draw Nitro's registers and what each holds; draw the "key released only if PCR0 matches" flow; write the rule name correctly (catch the aws:/kms: trap); and, handed a brand-new chip, point to its "code identity," "runtime registers," "freshness," and "trust root" columns on the map. Explain how reproducible builds let a stranger trust your enclave without trusting you.

sources
Nitro attestation — AWS · KMS condition keys — AWS · Nitro Security Module — github · reproducible builds — AWS blog · Intel TDX spec — PDF · AMD SEV-SNP — PDF