Reading list
Papers and standards on attestation
54 sources, in four shelves: foundations, protocols, attacks, and who runs it in production.
A starting library for anyone who builds on attestation. Every link was opened and checked on 12 November 2026.
Foundations
Where the ideas come from.
- Computer Security Technology Planning Study Anderson, 1972
- Trusted Computer System Evaluation Criteria (the Orange Book) US Department of Defense, 1985
- Design and Implementation of a TCG-based Integrity Measurement Architecture Sailer et al., 2004
- Direct Anonymous Attestation Brickell, Camenisch, Chen, 2004
- Bootstrapping Trust in a "Trusted" Platform Parno, 2008
- Intel SGX Explained Costan, Devadas, 2016
- Sanctum: Minimal Hardware Extensions for Strong Software Isolation Costan et al., 2016
Architectures, protocols and standards
How attestation is specified and proposed.
- RFC 9334: Remote ATtestation procedureS (RATS) Architecture IETF, 2023
- RFC 9711: The Entity Attestation Token (EAT) IETF, 2025
- RFC 9683: Remote Integrity Verification of Network Devices Containing Trusted Platform Modules IETF, 2024
- Concise Reference Integrity Manifest (CoRIM) IETF draft
- An Architecture for Trustworthy and Transparent Digital Supply Chains (SCITT) IETF
- RFC 8995: Bootstrapping Remote Secure Key Infrastructure (BRSKI) IETF, 2021
- FIDO Device Onboard Specification 1.1 FIDO Alliance, 2022
- DICE Attestation Architecture Trusted Computing Group
- TPM 2.0 Library Trusted Computing Group
- Integrating Remote Attestation with Transport Layer Security Knauth et al.; an early certificate-based design, since shown open to diversion attacks, 2018
- Attestation Mechanisms for Trusted Execution Environments Demystified Ménétrey et al., 2022
- Intel TDX Demystified: A Top-Down Approach Cheng et al., 2023
- Design and Verification of the Arm Confidential Compute Architecture Li et al., 2022
- Attested TLS formal analysis materials Sardar et al.
Breaking it
Attacks on attestation and on the hardware it rests on.
- Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution Van Bulck et al., 2018
- A Bad Dream: Subverting Trusted Platform Module While You Are Sleeping Han et al., 2018
- SEVered: Subverting AMD's Virtual Machine Encryption Morbitzer et al., 2018
- Insecure Until Proven Updated: Analyzing AMD SEV's Remote Attestation Buhren et al., 2019
- TPM-Fail Moghimi et al., 2019
- Plundervolt Murdock et al., 2019
- CacheOut and SGAxe van Schaik et al., 2020
- One Glitch to Rule Them All: Fault Injection Attacks Against AMD's Secure Encrypted Virtualization Buhren et al., 2021
- ÆPIC Leak Borrello et al., 2022
- faulTPM: Exposing AMD fTPMs' Deepest Secrets Jacob et al., 2023
- Downfall Moghimi, 2023
- CacheWarp Zhang et al., 2023
- BadRAM De Meulemeester et al., 2024
- Battering RAM 2025
- WireTap 2025
- TEE.fail 2025
- Intra-handshake attestation: relay attacks on attested TLS Sardar et al., 2026
In production
Designs and deployments published by companies that run attestation at scale.
- Private Cloud Compute: A new frontier for AI privacy in the cloud Apple, 2024
- Security research on Private Cloud Compute Apple, 2024
- Building Private Processing for AI tools on WhatsApp Meta, 2025
- Private AI Compute Google, 2025
- Confidential Inference via trusted VMs Anthropic
- Azure AI Confidential Inferencing: Technical Deep-Dive Microsoft
- AI Security with Confidential Computing NVIDIA
- GPU Remote Attestation With Intel Trust Authority Intel
- OpenPCC: Open and Confidential LLM Serving on Commodity TEEs Confident Security, 2026
- NEAR AI Cloud Integrates Intel Trust Authority NEAR AI
- Fortanix Brings Confidential AI to Cisco Secure AI Factory with NVIDIA Fortanix, Cisco, NVIDIA, 2026
- Technology preview: Private contact discovery for Signal Signal, 2017
- Technology preview for secure value recovery Signal, 2019
- Confidential computing: an AWS perspective Amazon Web Services
- Confidential Space reaches GA Google Cloud
- BuilderNet: block building in trusted execution environments BuilderNet
The list is a selection and will grow. Missing a paper, or found a mistake? [email protected]