Session Attestation for Unmodified TLS Services in Confidential Virtual Machines

• URL: http://arxiv.org/abs/2609.09668v1
• Date: Wed, 09 Sep 2026 03:36:24 GMT
• Title: Session Attestation for Unmodified TLS Services in Confidential Virtual Machines
• Abstract summary: We present SessionLatch, which provides session attestation while preserving all three.<n>A temporary latch holds client encrypted records while evidence exchange overlaps the application TLS handshake, then removes itself after verification.<n>SessionLatch reduces short-upload mean latency by 63.1%/23.0% relative to TNG in interleaved Linux/Windows experiments.
• Score: 0.9825966924601678
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Confidential virtual machines simplify the migration of existing services into trusted execution environments, yet attesting their network connections often requires changing applications, TLS implementations, or certificates. We present SessionLatch, which provides session attestation while preserving all three. The key insight is that a trusted observation of the server's locally generated ephemeral public key, combined with standard TLS key confirmation, establishes the TEE endpoint guarantee without accessing TLS secrets. This moves attestation integration to the operating system: a temporary latch holds client encrypted records while evidence exchange overlaps the application TLS handshake, then removes itself after verification. The resulting connection retains enterprise service authentication and the native TLS data path, with no additional payload encryption. Mutual attestation uses the same construction and overlaps evidence generation at both endpoints. We implement Linux andWindowsintegrationandevaluaterealHygonCSVattestation. SessionLatch reduces short-upload mean latency by 63.1%/23.0% relative to TNG in interleaved Linux/Windows experiments. These results show that session attestation can strengthen existing confidential services without making a permanent proxy part of their data path.

Related papers

• KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation [53.952294884822955]
  Large language model (LLM) API relays authenticate customers separately but often forward requests through shared provider credentials.<n>We present KeyPooling, a measurement method that traces customer identity through cache lookup and write.<n>We derive a defense contract: every customer must enter a provider-enforced domain.
  arXiv  Detail & Related papers  (2026-08-18T08:12:34Z)
• Weird Machines in Transport Layer Security [4.816146174353995]
  This paper extends weird machine theory to the Transport Layer Security (TLS) handshake and its two dominant implementations, OpenSSL and BoringSSL.<n>We show that legitimate TLS primitives compose into Turing-complete systems whose computation is coupled to authentication and trust decisions rather than physical actuation.<n>We validate this theory with two working demonstrations built on real OpenSSL code paths.
  arXiv  Detail & Related papers  (2026-08-13T18:28:01Z)
• TrustedARI: Towards Trust-Native Agentic Routing Infrastructure for Agentic AI [29.547987611061078]
  We present TrustedARI, the first trust-native agentic routing infrastructure for agentic AI.<n>It is built upon three core innovations: (i) an ARI-adapted three-party TLS handshake that enables the agent and ARI to jointly authenticate the service provider; (ii) a privacy-preserving query-construction protocol that allows the agent and ARI to collaboratively construct well-formed queries without exposing their respective private inputs; and (iii) a verifiable billing protocol that supports fair usage-based settlement.
  arXiv  Detail & Related papers  (2026-06-14T13:39:56Z)
• PriSrv: Privacy-Enhanced and Highly Usable Service Discovery in Wireless Communications [43.30406587083713]
  Existing protocols provide limited privacy protection, leaking sensitive device information and opening routes to network attacks.<n>This paper proposes a private service discovery protocol, called PriSrv, which enables both service providers and clients to specify fine-grained authentication policies.
  arXiv  Detail & Related papers  (2026-06-04T08:00:31Z)
• DIST-FL: Enhancing Security for TEE-based Aggregation in Federated Learning [37.95865837498057]
  Server-side adversaries can still manipulate client selection and replay aggregation to compromise system robustness and privacy.<n>We present DIST-FL, a distributed system of servers guarded by multiple TEEs forming an append-only ledger for privacy-preserved, robust FL aggregation.
  arXiv  Detail & Related papers  (2026-06-03T14:01:10Z)
• CapSeal: Capability-Sealed Secret Mediation for Secure Agent Execution [1.9473631530390483]
  CapSeal is a capability-sealed secret mediation architecture that replaces direct secret access with constrained invocations through a local trusted broker.<n>We describe a Rust prototype integrated with an MCP-facing adapter, formulate conditional security goals for non-disclosure, constrained use, replay resistance, and auditability.
  arXiv  Detail & Related papers  (2026-04-18T00:23:32Z)
• Signature Placement in Post-Quantum TLS Certificate Hierarchies: An Experimental Study of ML-DSA and SLH-DSA in TLS 1.3 Authentication [0.0]
  Post-quantum migration in TLS 1.3 should not be understood as a flat substitution problem in which one signature algorithm is replaced by another.<n>This paper presents a local experimental study of TLS 1.3 authentication strategies built on OpenSSL 3 and oqsprovider.
  arXiv  Detail & Related papers  (2026-04-07T17:13:10Z)
• Post-Quantum Identity-Based TLS for 5G Service-Based Architecture and Cloud-Native Infrastructure [0.5735035463793009]
  We present a certificate-free authentication framework for private distributed systems based on post-quantum Identity-Based Encryption (IBE)<n>Our design replaces certificate and signature based authentication with identity-derived keys and identity-based key encapsulation, enabling mutually authenticated TLS connections without certificate transmission or validation.<n>We apply this framework to cloud-native application deployments and latency-sensitive 5G Core networks.
  arXiv  Detail & Related papers  (2026-02-04T05:55:41Z)
• Managed TLS Under Migration: Authentication Authority Across CDN and Hosting Transitions [0.0]
  This study investigates how managed TLS platforms behave when a domain is moved away from the platform that originally issued and stored its certificate.<n> measurements show that platforms continue to serve the same certificate until it expires, even after DNS resolvers direct traffic toward new infrastructure.<n>Findings indicate that authentication authority remains with the previous platform for the entire lifetime of certificates issued during the delegation period.
  arXiv  Detail & Related papers  (2025-12-07T22:52:52Z)
• Lightweight, Secure and Stateful Serverless Computing with PSL [43.025002382616066]
  We present Function-as-a-Serivce (F) framework for Trusted Execution Environments (TEEs) The framework provides rich programming language support on heterogeneous TEE hardware for statically compiled binaries and/or WebAssembly (WASM) bytecodes. It achieves near-native execution speeds by utilizing the dynamic memory mapping capabilities of Intel SGX2.
  arXiv  Detail & Related papers  (2024-10-25T23:17:56Z)
• HasTEE+ : Confidential Cloud Computing and Analytics with Haskell [50.994023665559496]
  Confidential computing enables the protection of confidential code and data in a co-tenanted cloud deployment using specialized hardware isolation units called Trusted Execution Environments (TEEs) TEEs offer low-level C/C++-based toolchains that are susceptible to inherent memory safety vulnerabilities and lack language constructs to monitor explicit and implicit information-flow leaks. We address the above with HasTEE+, a domain-specific language (cla) embedded in Haskell that enables programming TEEs in a high-level language with strong type-safety.
  arXiv  Detail & Related papers  (2024-01-17T00:56:23Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.