Confidential computing keeps promising that hardware enclaves can turn hostile cloud infrastructure into something clients can verify. The new attested TLS research cuts into the part vendors prefer to wave past: verification still has to ride over a network protocol, and the protocol has to prove that the machine which produced the attestation is the same machine receiving the secret.
Muhammad Usama Sardar, Mariam Moustafa, and Tuomas Aura’s AsiaCCS 2026 work, published with formal ProVerif artifacts, found diversion attacks in Intel-style RA-TLS and the expired draft-fossati-tls-attestation design. Sardar’s HotSoS abstract says the relay attacks have been acknowledged by the CCC Attestation SIG, IETF, IRTF, and vendors, and that a high-severity CVE, CVE-2026-33697, was issued. The nastiest sentence is the architectural one: strong application-traffic binding may be impossible with intra-handshake attestation alone.
That is a control-plane wound, not a normal implementation bruise. Attestation says something about measured software state. TLS says something about a secure session. Attested TLS tries to weld those claims together. The failure appears when the weld grabs the wrong piece of the session: evidence can be bound to an ephemeral key, handshake state, or certificate flow without being tied strongly enough to the application traffic key that later protects the actual user data.
The GitHub advisory for CoCoS gives the production-shaped version. CoCoS versions v0.4.0 through v0.8.2 are vulnerable across AMD SEV-SNP and Intel TDX deployment targets. The advisory says an attacker who extracts the ephemeral TLS private key can relay the attested TLS session because the evidence is bound to the ephemeral key rather than the TLS channel. The client accepts the connection under false assumptions about the endpoint. There is currently no patch and no complete workaround. The v0.7.0 aTLS redesign did not remove the architectural weakness.
The prerequisite is ugly but plausible in the world confidential computing already admits exists: key extraction through physical access, transient execution, or side channels. If a TEE threat model waves those away completely, it has wandered into sales fiction. The whole field exists because host infrastructure can be hostile, compromised, compelled, or sloppy. Side-channel history keeps reminding everyone that silicon roots of trust are roots, not force fields.
The protocol distinction matters. Pre-handshake attestation can prove something before TLS identity has fully settled. Intra-handshake attestation tries to carry evidence during TLS negotiation. The researchers describe three levels of binding. Level 1 reaches early Diffie-Hellman material. Level 2 reaches the client’s handshake traffic key. Level 3 reaches the application traffic key, the key that protects the real data after the handshake. The reported finding says the strongest binding may require moving attestation after the handshake, using exported authenticators. The active draft-fossati-seat-expat-03 was updated on July 4 and points in that post-handshake direction.
This is why the sovereign-cloud angle has teeth. Vendors want confidential computing to sound like a jurisdictional escape hatch: run sensitive workloads in TEEs, let cryptography prove the cloud cannot peek, sell the result to regulated industries and governments. That pitch quietly depends on a clean chain from hardware identity to software measurement to session identity to data path. Break the session identity link and the sovereignty story turns into packet theater. The user may know a genuine enclave existed somewhere. The user still may send the secret through the wrong route.
Meta’s WhatsApp Private Processing audit by Trail of Bits is useful context because it shows the same class of pain from another side. Trail of Bits found 28 issues, including high-severity problems around unmeasured environment variables, ACPI tables, firmware patch-level validation, and attestation freshness. Meta patched those before launch. That audit lesson was implementation completeness: measure the inputs, validate the certificates, bind freshness to the session. The attested TLS finding moves the knife lower. Even careful measurement can lose if the protocol composition cannot prove who receives the application traffic.
Manual review misses this kind of bug because the bad state can look like a valid run. A human audit samples code paths and checks common misuse. Formal analysis exhaustively asks whether the claimed authentication property actually follows from the protocol. The repository’s result table is blunt: both IRA-TLS and TLS-a preserve some attestation properties while failing server identity, server authentication, compound authentication, and agreement of all parameters. That is the expensive lesson. A protocol can protect evidence integrity and freshness while failing the identity property that made the evidence useful.
The fix path also says something uncomfortable about standards work. The expired intra-handshake draft reads like the natural engineering move: carry the attestation during TLS, avoid extra round trips, bind runtime claims into the transport handshake, make the system neat. Reality replies with a relay attack. The post-handshake exported-authenticator path is less cute. It waits until TLS has a stronger channel context, then asks the attester to prove itself inside that established relationship. Boring wins again. Security engineering keeps murdering elegance because elegance keeps sneaking assumptions past the threat model.
The next wave of confidential AI infrastructure will stress this boundary harder. Private inference, regulated medical analysis, genomic processing, enterprise document search, and government cloud workloads all want the same product sentence: send sensitive data to a machine you do not administer because cryptography proves the operator cannot read it. That sentence has too many nouns. Machine. Operator. Workload. Session. Key. Route. Jurisdiction. If any one of them gets collapsed into the wrong abstraction, the checkmark lies.
The lesson is narrow and mean: confidential computing needs protocol identity as much as enclave identity. Attestation has to be fresh, scoped, measured, certificate-backed, and bound to the traffic that carries the secret. Anything weaker creates a haunted trust receipt: valid evidence from the right kind of machine, presented through the wrong conversation.