[CRITICAL SECURITY] bootstrap_measurement_policy() accepts any TEE image attestation bypass at root key bootstrap

[Sertug17]

Summary

bootstrap_measurement_policy() in bin/attestation-service/src/server.rs:321 unconditionally returns dangerously_accept_any_for_testing(). During root key bootstrap, the attestation service performs zero measurement verification any TEE image, including an attacker controlled modified enclave, can participate and receive root key material.

Affected Code

File: bin/attestation-service/src/server.rs, lines 321–326

fn bootstrap_measurement_policy() -> MeasurementPolicy {
    // TODO: load from manifest
    dangerously_accept_any_for_testing()
}

Attack Scenario

1. Attacker deploys a modified enclave image on a reachable node
2. Modified enclave initiates root key bootstrap handshake
3. bootstrap_measurement_policy() accepts it no measurement check occurs
4. Attacker's enclave receives or reconstructs root key material
5. All secrets protected by the network root key are compromised

Impact

Severity: Critical

The entire TEE attestation model for the bootstrap phase provides no protection.
The codebase is otherwise carefully designed — zeroize discipline on transport
buffers, per-purpose key derivation, LUKS key handoff — but all of this is
rendered moot if an attacker can obtain the root key at bootstrap.

Root Cause

The real implementation (loading measurement policy from the manifest/registry) is not yet done. The placeholder is dangerously_accept_any_for_testing(), a function whose name explicitly signals it must never reach production. A // TODO: load from manifest` comment confirms this is known incomplete.

Expected Behavior

bootstrap_measurement_policy() must load the expected measurement hashes (MRTD, RTMRs, etc.) from the network manifest or on chain MeasurementRegistry and reject any enclave whose measurements do not match.

The measurement-admission and measurement-registry-client crates already exist in this repo for exactly this purpose the wiring into bootstrap_measurement_policy() is the missing piece.

Suggested Fix

fn bootstrap_measurement_policy(manifest: &NetworkManifestV1) -> Result<MeasurementPolicy, Error> {
    MeasurementPolicy::from_manifest(manifest)
        .map_err(|e| Error::InvalidManifest(e))
}

Additionally, dangerously_accept_any_for_testing should be gated behind #[cfg(feature = "testing")] so it is unreachable in production builds.

Notes

• The measurement-admission crate (policy compiler) and measurement-registry-client (on chain registry reader) are already in scope this is a wiring issue, not a missing primitive.
• dangerously_accept_any_for_testing appears to be used in tests; those should remain valid under the testing feature flag.
• This finding was discovered via static code review of the public repository.