Don't let TEEs break your MPC
Combining MPC and TEEs offers defense-in-depth but introduces rollback and side-channel risks if attestation and host trust models are mishandled. TEEs can elevate semi-honest MPC protocols to malicious security by attesting to correct code execution. However, untrusted hosts can perform rollback attacks on filesystem state, causing nonce reuse and private key disclosure in threshold signatures.
Detection / Hunteropenrouter
Immediate Actions
- Audit TEE deployments for incomplete attestation measurements
- Verify attestation certificate chains back to manufacturer roots
- Implement strict security version number validation for TEE firmware
Key Takeaways
- TEE attestation can mitigate MPC issues like ambiguous encoding and missing input validation.
- Malicious hosts can roll back filesystem state to force nonce reuse in threshold signatures.
- Incomplete attestation measurements allow attackers to inject unmeasured code via LD_PRELOAD.
- Intel attestation tools allow known-vulnerable firmware to pass for one year post-disclosure.
- Using multiple TEE vendors avoids centralizing trust in a single hardware manufacturer.
Attack Chain
- Initial Access: Attacker controls the host system running a TEE-based MPC threshold signer.
- Defense Evasion: Host manipulates filesystem state after TEE deletes a used pre-signature.
- Execution: TEE reads the rolled-back pre-signature file, reusing the nonce.
- Exfiltration: Nonce reuse allows the attacker to recover the TEE's private key share.
Affected Systems
- Threshold signature schemes
- Schnorr/ECDSA threshold signatures
- Intel TDX
- AMD SEV-SNP
- AWS Nitro Enclaves
- Meta WhatsApp Private Inference
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | TEEs are designed to be opaque to the host OS and standard EDR agents. |
| Network Visibility | Medium | Host can observe timing and metadata, but TLS between TEEs protects content. |
| Detection Difficulty | Hard | Attacks occur within or manipulate hardware-backed environments opaque to standard EDR. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Filesystem rollback events affecting cryptographic nonce storage (T1211) | Filesystem integrity monitoring alerts | Defense Evasion | Low — legitimate state restores are rare |
| Abnormal timing patterns in TEE execution indicating side-channel attacks (T1499) | Host-level CPU scheduling and timing logs | Discovery | High — normal scheduling variance |
Required Log Sources
- TEE attestation logs
- Filesystem integrity monitoring
- Application logs inside TEE
Key Behavioral Indicators
- Repeated nonce values in threshold signatures
- Attestation quote missing critical configuration files
- Unmeasured code execution inside TEE enclave
Control Gaps
- Standard EDR lacks visibility inside TEE memory
- Filesystem integrity monitoring may not cover TEE internal storage
- Attestation verification may skip critical measurements
False Positive Assessment
Low — cryptographic nonce reuse and filesystem rollback are abnormal in production TEE environments
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Terminate peer-to-peer MPC communications inside TEEs
- Use multiple TEE vendors to distribute trust
- Harden TEE images by removing unnecessary drivers and services
- Enforce constant-time cryptographic implementations inside TEEs
User Protection
- Update TEE firmware to patch known vulnerabilities
- Monitor for filesystem rollback attacks on TEE storage
Security Awareness
- Train developers on TEE-specific threats like rollback and side-channel attacks
- Require reproducible builds and binary transparency for TEE measurements
MITRE ATT&CK Mapping
Stealth
Credential Access
Impact
Plain-Language Summary
Multi-party computation (MPC) and trusted execution environments (TEEs) are combined to improve security for sensitive cryptographic operations. However, a malicious server host can manipulate the TEE's storage to reuse cryptographic nonces, which leaks private keys. Organizations using this combination must carefully verify the TEE's software state and use multiple hardware vendors to avoid centralizing trust.