Confidential computing's trust mechanism is broken. The fix may not exist

Confidential computing is currently being sold as the foundation for European sovereign cloud projects, promising a secure way to run workloads in trusted execution environments. However, new research from Muhammad Usama Sardar at TU Dresden reveals a critical flaw in the remote attestation protocols meant to verify these systems. The core issue lies in attested TLS, a protocol designed to prove that a server is running genuine hardware and unmodified software.

Sardar’s work, which utilized formal verification tools, uncovered relay attacks where traffic intended for a secure server can be silently redirected to a malicious one. These findings are not mere theoretical exercises. They affect production systems like Meta’s Private Processing for WhatsApp, Edgeless Systems’ Contrast, and the open-source Cocos AI platform. The researchers demonstrated that current intra-handshake attestation methods cannot cryptographically bind evidence to the application data once the connection is established.

What makes this discovery significant is the failure of traditional manual security audits to catch these vulnerabilities. Trail of Bits, for instance, reviewed Meta’s implementation without detecting the flaw. This highlights the difference between manual sampling and formal methods which exhaustively test protocols against all possible threat scenarios. Despite this, major cloud providers continue to market these technologies as providing full, auditable control over sensitive customer data.

Industry bodies like the IETF and the Confidential Computing Consortium have acknowledged these relay attacks, yet the marketing messaging remains unchanged. Even worse, the administrative response to these findings included delays in publishing the research artifacts, suggesting an reluctance to address the underlying architectural reality. For organizations relying on these systems to maintain digital sovereignty, this presents a significant risk. The research indicates that the highest level of cryptographic binding required for true security may be impossible to achieve within the current architecture of intra-handshake attestation. Experts now suggest that developers should abandon these methods entirely in favor of post-handshake attestation to maintain actual data integrity.