seal

How it works

Markdown

Enclaves and attestation

How your SDK knows it's talking to a real enclave running a released build, before it sends anything.

The enclave proves it runs a released build on a genuine chip. Without that proof, your SDK sends nothing.

TEEs and attestation#

A TEE (trusted execution environment) runs a program in memory the chip encrypts, so the host can't read it. Seal's enclave runs in Azure confidential containers on AMD SEV-SNP chips.

Attestation says which program is inside. The chip signs a report of its firmware version and the program's fingerprint. The signature chains up to AMD, so nobody else can forge it.

The fingerprint#

The fingerprint, or measurement, is a hash of exactly what launched. Builds are reproducible, so you can rebuild a commit and compare.

Published release · signed 2 of 3 · in the transparency log

5f02a001f953d276a4c20efb1ed001f5bc22c44a12d86761d3a5f074f5351b5a5e53998dc1c686613526a839258a991c

Reported by the chip · signed by AMD's key in the processor

5f02a001f953d276a4c20efb1ed001f5bc22c44a12d86761d3a5f074f5351b5a5e53998dc1c686613526a839258a991c

attestation fresh, challenge answered, release signed

verified · opening session

FigureThe chip's report matches a published release, so the SDK goes ahead. It checks again on every new connection.

What your SDK checks#

Any failed check stops with VerificationFailed, and nothing is sent.

  • The report is at most 120 seconds old.
  • A fresh challenge ties it to this TLS connection, so a replayed or relayed report fails.
  • Two of three release keys signed the fingerprint, it's in the log, and its waiting period is over.
  • The enclave's keys carry the key guardian's certificate.
  • It serves your tenant's root id, from SEAL_TENANT=<tenant>@<root id>.
  • The chip's firmware meets the floor for its chip family. Floors only rise, and the witnesses enforce that.

The SDK and CLI carry the keys these checks use.

Keys come from the key guardian#

A replica boots with no keys and writes nothing to disk. The key guardian runs the same checks, then sends your tenant's keys to that replica alone. An unreleased build never gets keys.

The guardian's master key sits in Azure Key Vault, released only to the guardian's exact fingerprint.

What attestation doesn't prove#

  • That the code is correct. The waiting period gives people time to read it.
  • That a fingerprint matches its commit. Rebuild to confirm.
  • That the chip has no unknown flaws. You trust AMD.
  • That the service stays up. The host can switch the replica off.
  • What your app does with a session. See What an attacker gets.