Metraipolis › archive › dc_bd9c2ca63abc

Session Attestation for Unmodified TLS Services in Confidential Virtual Machines — arXiv:2609.09668

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.09668
License (as archived): CC0-1.0
Archived: 2026-10-16T07:54:39.898Z
SHA-256 of the archived text: 29fafa6dc7680bdda59d728370202bf3980a21f99cc586d4103a7895bb85be7e
Stable URL of this page: https://metraipolis.com/documento/dc_bd9c2ca63abc

How to cite

Session Attestation for Unmodified TLS Services in Confidential Virtual Machines — arXiv:2609.09668 — arXiv (en), https://arxiv.org/abs/2609.09668 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_bd9c2ca63abc (Metraipolis archive dc_bd9c2ca63abc, sha256 29fafa6dc7680bdda59d728370202bf3980a21f99cc586d4103a7895bb85be7e)

BibTeX

@misc{dcbd9c2ca63abc,
  title = {Session Attestation for Unmodified TLS Services in Confidential Virtual Machines — arXiv:2609.09668},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.09668},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_bd9c2ca63abc; sha256 29fafa6dc7680bdda59d728370202bf3980a21f99cc586d4103a7895bb85be7e},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.09668. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Confidential cloud services aim to protect sensitive requests from the infrastructure that executes them. However, running a service inside a trusted execution environment does not ensure that users' plaintext appears only within the protected environment. We formulate Endpoint-Substitution Relay (ESR), a common attack outcome in which an adversary receives plaintext at a client-accepted endpoint while relaying requests to the legitimate service to preserve correct behavior. We present TLSLatch, a transparent session-attestation mechanism for services running in confidential virtual machines. TLSLatch attests the protected origin of the server's ephemeral TLS 1.3 key share and gates outbound traffic until verification succeeds. It requires no changes to applications, TLS libraries, certificates, or application protocols, and adds no extra payload-encryption layer. We implement TLSLatch with a hardware-backed Hygon CSV CVM server and clients on Linux, Windows, and macOS. Across these platforms, TLSLatch reduces completion time for 1KB requests by 56.9%--65.5% compared with nested TNG, and for 64MB requests by 43.8%--82.4% compared with CMaaS using application-key reuse. These results show that transparent session attestation can preserve existing TLS stacks while adding low-overhead endpoint binding to confidential cloud services.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-10 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2609.09668 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-16T07:37:41.559Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-10?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).