Skip to content

Commit 17951fa

Browse files
authored
Update overview.md
1 parent ebff96f commit 17951fa

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

articles/attestation/overview.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -77,11 +77,11 @@ Azure Attestation is the preferred choice for attesting TEEs as it offers the fo
7777

7878
## How to establish trust with Azure Attestation
7979

80-
1. **Verify if attestation token is generated by Azure Attestation** - Attestation token generated by Azure Attestation is signed using a self-signed certificate. The signing certificates URL is exposed via an [OpenID metadata endpoint](https://learn.microsoft.com/en-us/rest/api/attestation/metadata-configuration/get?tabs=HTTP#get-openid-metadata). Relying party can retrieve the signing certificate and perform signature verification of the attestation token. See [code samples](microsoft-azure-attestation/JwtValidationHelper.cs at master · Azure-Samples/microsoft-azure-attestation (github.com)) for more information
80+
1. **Verify if attestation token is generated by Azure Attestation** - Attestation token generated by Azure Attestation is signed using a self-signed certificate. The signing certificates URL is exposed via an [OpenID metadata endpoint](https://learn.microsoft.com/en-us/rest/api/attestation/metadata-configuration/get?tabs=HTTP#get-openid-metadata). Relying party can retrieve the signing certificate and perform signature verification of the attestation token. See [code samples](https://github.com/Azure-Samples/microsoft-azure-attestation/blob/master/sgx.attest.sample.oe.sdk/validatequotes.net/Helpers/JwtValidationHelper.cs#L21-L22) for more information
8181

82-
2. **Verify if Azure Attestation is running inside an SGX enclave** - The token signing certificates include SGX quote of the TEE inside which Azure Attestation runs. If relying party prefers to check if Azure Attestation is running inside a valid SGX enclave, the SGX quote can be retrieved from the signing certificate and locally validated. See [code samples](microsoft-azure-attestation/MaaQuoteValidator.cs at e7f296ee2ca1dd93b75acdc6bab0cc9a6a20c17c · Azure-Samples/microsoft-azure-attestation (github.com)) for more information
82+
2. **Verify if Azure Attestation is running inside an SGX enclave** - The token signing certificates include SGX quote of the TEE inside which Azure Attestation runs. If relying party prefers to check if Azure Attestation is running inside a valid SGX enclave, the SGX quote can be retrieved from the signing certificate and locally validated. See [code samples](https://github.com/Azure-Samples/microsoft-azure-attestation/blob/e7f296ee2ca1dd93b75acdc6bab0cc9a6a20c17c/sgx.attest.sample.oe.sdk/validatequotes.net/MaaQuoteValidator.cs#L62-L65) for more information
8383

84-
3. **Validate binding of Azure Attestation SGX quote with the key that signed the attestation token** – Relying party can verify if hash of the public key that signed the attestation token (retrieved in step 1) matches the report data field of the Azure Attestation SGX quote (retrieved in step 2). See [code samples](microsoft-azure-attestation/MaaQuoteValidator.cs at e7f296ee2ca1dd93b75acdc6bab0cc9a6a20c17c · Azure-Samples/microsoft-azure-attestation (github.com)) for more information
84+
3. **Validate binding of Azure Attestation SGX quote with the key that signed the attestation token** – Relying party can verify if hash of the public key that signed the attestation token (retrieved in step 1) matches the report data field of the Azure Attestation SGX quote (retrieved in step 2). See [code samples](https://github.com/Azure-Samples/microsoft-azure-attestation/blob/e7f296ee2ca1dd93b75acdc6bab0cc9a6a20c17c/sgx.attest.sample.oe.sdk/validatequotes.net/MaaQuoteValidator.cs#L78-L105) for more information
8585

8686
4. **Validate if Azure Attestation code measurements match the Azure published values** - The SGX quote embedded in attestation token signing certificates includes code measurements of Azure Attestation, like mrsigner. If relying party is interested to validate if the SGX quote belongs to Azure Attestation running inside Azure, mrsigner value can be retrieved from the SGX quote in attestation token signing certificate and compared with the value provided by Azure Attestation team. If you are interested to perform this validation, please submit a request on [Azure support](https://azure.microsoft.com/en-us/support/) page.
8787

0 commit comments

Comments
 (0)