Security1 publisher2 min readPublished
Host-controlled storage rollback can make TEE-hosted threshold signers leak key shares
Trail of Bits says a malicious host could roll back a TEE-hosted threshold signer's storage and force nonce reuse that leaks its private key share. The firm's advice is to keep the protocol sound without the enclave and tie attestation to each MPC party's identity.
The Watch · Security desk
What happened
- Trail of Bits published guidance on threshold signature schemes, which it says are increasingly deployed inside trusted execution environments.
- In its example, a malicious host rolls back the filesystem after a signer deletes a used pre-signature, so the signer reuses its nonce share and discloses its private key share.
- The firm says pairing TEEs with MPC is worth it only when the enclave is an added defense-in-depth layer on top of a protocol that is sound by itself.
- Its recommended practices include strong attestation processes bound to the identities of the MPC parties.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The operator of the host machine, the party the enclave was meant to shut out, can extract a key share while attestation keeps reporting a healthy signer.
- decision Teams that chose a semi-honest protocol because enclaves would keep parties honest have to re-examine that choice for any signing state stored outside the enclave.
- cost Mixed-vendor signing quorums carry the cost of writing and maintaining separate attestation verification code for each TEE vendor.
The attacker in Trail of Bits' example is the host: the operating system and hypervisor under the enclave, and whoever controls them [3]. TEEs are built to protect code and data from exactly that privileged software [7]. The firm offers the rollback as an example of what a host "could" do [3], in a post about the pitfalls it sees most often in audits [5]. The post does not name an affected product or a CVE [14].
The firm's own list of TEE guarantees shows why the enclave misses it. Integrity covers attempts to modify the TEE's memory or execution state from outside [8]. An attestation quote is a signed bundle of hashes of the TEE's software, configuration and hardware state [9]. A pre-signature file restored on the host's disk falls outside both [1]. The signer that has just reused its nonce share is still running the measured code, and it can still produce a valid quote [1].
The gap is widest where the enclave is used to relax the protocol. Trail of Bits writes that attestation guaranteeing every party runs the correct implementation "effectively elevates semi-honest protocols to provide malicious security guarantees," and limits that to "certain classes of attacks" [6]. Semi-honest security assumes every participant follows the specification exactly [11]. Malicious security assumes participants may deviate arbitrarily [12]. Rollback breaks the semi-honest assumption without touching the code. The binary is honest and the state it reads is stale. A deployment that counts on attestation for malicious security has no check in the protocol to reject a pre-signature that comes back after deletion [2].
Attestation verification also has to be built for each vendor. Each TEE is provisioned at manufacture with a private key and a certificate chaining to a root held by a trust anchor, typically the manufacturer [13]. According to the post, the checks a verifier must run are not uniformly defined and are partly vendor-specific; it cites Intel's TDX documentation [10]. A signing quorum whose parties sit on different vendors' TEEs needs a separate verification path for each vendor [3].
What to watch
- A CVE or vendor advisory tying pre-signature rollback to a shipping MPC wallet or custody product would turn this design warning into a patch cycle.
- Custody providers running threshold signers in TEEs disclosing whether their protocol is semi-honest or maliciously secure, and where spent pre-signatures are recorded.