Tobin Feldman-Fitzthum
Tobin Feldman-Fitzthum
@ryansavino can you remove the WIP from the title? Let's try to get some reviews here.
This can be quite dangerous because it exposes valid generic evidence to a container i.e. a so-called evidence factory attack. It is also subpar because it introduces a platform-specific API...
@pegahnikbakht Kata (without CoCo) supports starting confidential guests, but if you want to do more advanced things (like getting the attestation report), you should think about using CoCo. As mentioned,...
> can you elaborate more what is the security issue of attesting the container directly In this case you aren't attesting the container at all. Due partly to implementation gaps...
> with the execution policy feature in place, shouldn't this make the container image part of the attestation report and mitigate this kind of attack? Currently I don't think the...
> what's the difference on exposing the device and exposing the rest API which also will generate an evidence for the workload? Turning on the API changes the measurement. It...
Let's merge this if you are happy with it @Xynnn007
I guess someone should update `docker-compose up -d` to `docker compose up -d` in that doc.
Apparently the latest upstream host patches no longer support setting the extended report (which the verifier currently requires), so we should make sure we implement some kind of fallback. If...
At the moment our reference value provider is simplistic. It is a key-value store that is provisioned by the operator of the KBS. We are on the verge of implementing...