In confidential computing, a user's verification server (the verifier) checks the attestation report received from a VM-based TEE before handing over the key that decrypts the data. Which is the most appropriate set of things for the verifier to check?

Answer: A. That the signature chains to the CPU vendor's key, the boot-time measurements are as expected, the TCB version is at or above the fixed version, and the verifier's nonce is included

Checking the signature shows only that the report came from a genuine TEE. What booted inside is checked by comparing the measurements with known-good values, and the presence of the nonce sent by the verifier shows that the report was made just now and is not a replay. Moreover, a TEE running firmware or microcode from before a vulnerability was fixed can still produce correctly signed reports, so the verifier also checks that the TCB version (security version numbers) in the report is at or above the fixed version. If the report includes the hash of a public key for communication, the key handed over can be made to reach only that virtual machine.

• A. Correct. Origin, contents, version and freshness are all checked.
• B. Even with a valid signature, the TEE may be running unexpected software or old firmware from before a fix.
• C. A name, address or memory size does not show whether the TEE is genuine or what is running inside it.