On Attestation Dilution

The trust we place in "trusted execution environments" is based solely on the evidence of the attestation. The attestation provides a proof of genuine hardware and a list of software hashes. In theory, the hashes are sufficient to evaluate the correctness and security properties of the system. In practice, however, hashes map to closed-source firmware that cannot be identified or audited by a user of the system. In this paper we propose a simple new metric, called attestation dilution, to guide system design toward a more open and trustworthy infrastructure. The attestation dilution of a system is the number of hashes in the attestation that cannot be verified by a user. Ultimately, we believe that principled system design can lead to undiluted attestations, meaning that the system can be fully audited for providing the advertised security properties.