[Ufmrg] Re: EarlyAttestationBleed: Three Critical-severity Vulnerabilities of CVSS ≥ 9.0 in Confidential Computing
Songbo Bu <bluedognull@gmail.com> Tue, 22 September 2026 01:58 UTC
Received: from mail-qv2-x10.google.com (mail-qv2-x10.google.com [IPv6:2607:f8b0:4864:33::10]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by mx.ietf.org (Postfix) with ESMTPS id 5E96830 for <ufmrg@irtf.org>; Tue, 22 Sep 2026 01:58:30 +0000 (UTC)
Authentication-Results: mx.ietf.org; dkim=pass header.d=gmail.com header.s=20251104 header.b="qf/c+x/3"; arc=pass ("google.com:s=arc-20260327:i=1"); dmarc=pass (policy=none) header.from=gmail.com; spf=pass (mx.ietf.org: domain of bluedognull@gmail.com designates 2607:f8b0:4864:33::10 as permitted sender) smtp.mailfrom=bluedognull@gmail.com
Received: by mail-qv2-x10.google.com with SMTP id 6a1803df08f44-9123599f5e3so35091366d6.0 for <ufmrg@irtf.org>; Mon, 21 Sep 2026 18:58:30 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1790042310; cv=none; d=google.com; s=arc-20260327; b=ZTesfBeS7TyiFtlzN40E97NGwTjtJlUW5zDArBPR11IYSv6spVvCqrbV12k17KpS7z sVZbkaM82BbNHnmhtYxHvXLgLvEAb/mjW9vAg5TmiMNVJCCQMsFhYYtg7JUeuIqEnZZi ZknSGYTpM2G9YVW0d0YYgxMP6DBKOuA3eO3u7jg8LtiDo84peBvxOngvYi6FkO7nPtLS /Dzo2iIM1/Me15lcJFF/VAozBNNq/f7Wcc7Qgy9VhiXv9Yq2RJQDzB1NCIKaG/AAnXNA I4+LnzjXCZBNp4yw8I6vXreBxIu2LWIz7y3hEP3oBBc79SGEh/2jiOVr2h2OQEsdc6ZK bi4Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :dkim-signature; bh=IvFbZp8Ci+qbenym4FLP5hNFfvXSXeP+LXr5EMyhQVQ=; fh=WW0CzoRftUM6ShqDEaarnFCt0tXbAT15cbW8iJzzhTY=; b=TawYoax6pHxIYdFL1OVSQW7bY08BT+3zVY/pW8aKOo/xCaA37zYZ7JOjtvqfACGx9r wUso5Da7NNKZF3JoiBiBSRLs5KnPfSqA0GxvKuaWzM5w9qHDQKTCEz10aIX8svTJ91lL XgVLvC/X2UYi1CyLyk0H7phs5zEWcmEcPyOXZCGZLty59fTDFxUrLmZQn++60vDwZU74 V4qyXpQffwJbxqnzXAVbMEJ6vBsaYpG4P4lrpyIsFLHBBzBffePL5u1ZYkmDhFx5cDik 8g2XyQMFr/FTrRYWL/0p5xzSrqhdoSX295NWDCyJ22KG1BsneVlunYOWQSyvGLJFy4x8 QCdw==; darn=irtf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790042310; x=1790647110; darn=irtf.org; h=content-type:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to :content-type; bh=IvFbZp8Ci+qbenym4FLP5hNFfvXSXeP+LXr5EMyhQVQ=; b=qf/c+x/33JcGVL5ObfTepL7PVhRbPFJFWskG6t2q7r4UcxIDM/wl2AJIziifTY12ut mwBqxkVSqtJB9tkoX0jg/KcWZRZ4PuKsd3IdOElj71/tJ8ubDUH/zmtRTchW6TdXwwT4 W3+1/62SRhWPiLXCFEKyicn5No6ximq5xGcYLqaVWxiMnB91RQ8klHR4QQQYhr3cPxL7 UfSWmc1OrIYO/6+L9SBtnO3xk85dObtPscR997Dk2Ca7QHSa15ndJEexs39uWH/HxLrn Uoi6ok4CQCg0tcTo1CFmalS5spwTfxPlF1nXqMqwh7Ll51Y1h+RR6u5EpN6R4J9kCNFb X2+w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790042310; x=1790647110; h=content-type:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=IvFbZp8Ci+qbenym4FLP5hNFfvXSXeP+LXr5EMyhQVQ=; b=YZDmzNL2qohDoNfc/TKOKzfhheaQBh140ntL3gjy625cwzSgG0dGG5LQUHfYV//3Pk KONGFLG1Lpj6JTs3f7vN3V75N0OtDHF+95qTk63nxgmXRIN7KfM/BFKh6sP3u7nAqFYQ DWEuOf0KrDyZlcTpf+J0dUNOQL+qeM/ibAhUPmEonznK87Yu+bInDnHbT4hzvY5AFpGm kKzNEkuAWJBn2JUIPK+hyXccZPuWwx6x5ScLyrwUZmqWrxV47PbcQSiN8jZRI/dJUScT WsIov1zrZvxQg29wgAaGqc/u7cNqxY7wZHZWzI9iikSNsNmM/bFLKahRU3GZrLDLm3Pp 8VqQ==
X-Gm-Message-State: AFuF++l2gTCP28KFqjM8cv/hqG3jSPtr+HQDY8FYq3Bif/cjAEN8H0vW DRLwpGyFcHyjlJwqZCxTEvULSfeb95wRU3zsI+/nasTVdYs2agmbMpbeQj7DUkNHPrnL10saWDC cORbKzZC21HOTIHXL/92WPKFDOSZKWOlNRVbhte0=
X-Gm-Gg: AYBFou15R3pI5NmuyibYn7iYzjSwBDz+2KI4k8ReCP/B8KMJzsOm3RqgxpOaqCJ6B9w szlsJZvc61Yhvqq1tcR6dmG83nBmY2q6sDisW6m24wjoMy51M36O9N5Oy2s0atEmoUX9N6YF5kM 1xOr0+nMmT7J0WfmeBxENaHtVeWsPMtUNEvAAAYfPotiYaILGMhlbN0IglvLbU/8wDF0B86OTEd m/8sm5I4x+6rNT1CUFTm1CDLu3QrTyR/ATndZ1rAC3SWBhDc2Y9e4UckIhRuSIuIxw4yVJ8pKt/ lSVJXzXKYPAdotzRNc4vpgIQbPIpcszQUwGlV3g2pH6Bj/gu5zCq22PVtamV61IIdzaIQi1rkGp BIYAltejle1XjaNqrYWzpsuwZTP2Zpz4QMaDOFf4CLwCX21d+TqGrMfy43UubGwqyYwVzPOiA56 0yP36uk6jsfgQQNPZczxYdcQ==
X-Received: by 2002:a05:6214:2301:b0:912:d9b:aa32 with SMTP id 6a1803df08f44-913fc9301d2mr34876046d6.32.1790042309201; Mon, 21 Sep 2026 18:58:29 -0700 (PDT)
MIME-Version: 1.0
References: <4b968f77-631e-4d26-a86d-280dd9aee66e@tu-dresden.de>
In-Reply-To: <4b968f77-631e-4d26-a86d-280dd9aee66e@tu-dresden.de>
From: Songbo Bu <bluedognull@gmail.com>
Date: Tue, 22 Sep 2026 09:58:16 +0800
X-Gm-Features: AcwNN1WZf4KC-CQz_L0yeXXJqX6wEgNDktoJAXPMM-k-4gvN7Svih_NQNoZlJIQ
Message-ID: <CAK08nYYR2nNe3v=dULaehvzpq_-xzrBafBdGpWg5TEBaj9MkXQ@mail.gmail.com>
To: ufmrg@irtf.org
Content-Type: text/plain; charset="UTF-8"
X-Spamd-Bar: --
Message-ID-Hash: 5DZ25HKGNZHVXTMM2MP2LYIG65GZPXZD
X-Message-ID-Hash: 5DZ25HKGNZHVXTMM2MP2LYIG65GZPXZD
X-MailFrom: bluedognull@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.10
Precedence: list
Subject: [Ufmrg] Re: EarlyAttestationBleed: Three Critical-severity Vulnerabilities of CVSS ≥ 9.0 in Confidential Computing
List-Id: Usable Formal Methods Research Group <ufmrg.irtf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ufmrg/mf_CtbtSDHPz3uMHRXele2vwYr8>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ufmrg>
List-Help: <mailto:ufmrg-request@irtf.org?subject=help>
List-Owner: <mailto:ufmrg-owner@irtf.org>
List-Post: <mailto:ufmrg@irtf.org>
List-Subscribe: <mailto:ufmrg-join@irtf.org>
List-Unsubscribe: <mailto:ufmrg-leave@irtf.org>
Hi all, As a co-author, I support further discussion of this work in UFMRG. I see particular value in connecting formal analysis with implementation-level testing to inform practical guidance for attested TLS. Feedback on the threat models, security properties, and how the formal assumptions map to implementation behavior would be especially valuable. I would welcome independent review and collaboration on these questions. Best regards, Songbo Bu
- [Ufmrg] EarlyAttestationBleed: Three Critical-sev… Muhammad Usama Sardar
- [Ufmrg] Re: EarlyAttestationBleed: Three Critical… Songbo Bu