.
after being creation.
On circular with the flipping is a default, and it's a new tab.
However, it's a familiar.
It can not keep created attestation key.
On the other hand, AWS Azure GCP can keep
attestation key.
However, we don't know that key is kept
after boot.
The estimation of secure boot also depends on
crowd benders.
AWS and Sakura cannot set secure boot.
On the other hand, Azure and GCP can set
as well as can change the status of secure boot.
However, GCP can not.
Okay.
So, I investigate the status of TPN persistent keys.
So, we can set endorsement key and attestation key
to the number of memory of boot EPN.
It can save after reboot, except Sakura,
because Sakura is a merit EPN.
But we cannot know that key is saved safely
after power on.
If you have answer, please tell me.
So, from here, I want to talk about
Internet experience feature.
Internet experience has two types of measurement.
MRTD, measurement of trust domain register.
It keeps the value of TD BIF, trust domain
battery hardware.
On the other hand, RTMR,
Lantang measurement registers.
It protects the registers for RTMR.
So, some component measured after boot power on.
It works as TPN.
Measurement component, and measure of software
is listed in the table.
So, this slide shows two useful,
X.
I got the most interesting result.
On Azure, the measurement by MA,
and TDX code paths are different.
So, it's a lead paths, shows the lead paths,
all that of hash number.
So, I guess it is caused by a difference between TDX buzzer,
because TDX, TDX buzzer,
whole LTDX buzzer 5, over different order.
Most of the interesting result is on Azure,
RTMR shows all zero.
On the other hand, GCP shows some values for RTMR,
from zero to two.
I think this reason is caused from the interface
to get the body of MRTMR, RMTR,
an intermediate register.
So, because Azure does not apply the interface
such as CIS from our SEPI,
slash tables, slash data, slash CCEL.
So, investigate the BTP and the Secular Boot status.
Integrity DX, as well as Integrity DX use,
slash TPM zero, or a test action interface.
On the other hand, GCP use, slash TDX guest.
It's a part by open source interface.
And the situation with TPM and Secular Boot is same to set S&B.
I also investigate the TPM positive keys on TDX.
The situation is same to MD set S&B.
Okay, I want to skip SGX.
I open this slide, please check the data from the slide.
I want to discuss, so the situation will be kept
on Secular Boot, depend on, could have the vendor.
So, only, I'm not sure it's only.
So, it's not measured by SEPI remote attetation.
TPM can measure, however, we can not trust BTP,
or cost attention to William.
And second question is, Interoperability.
So, we can use confidential computing on each credit vendors.
However, the attestation interface is different,
and the result are changed, even if the CPE is same.
The difference may cause interoperability problem,
for example, it migrate to another credit vendors.
So, conclusion.
So, each credit has all each security policy,
and affects the remote attestation.
So, we think we need to understand a situation
when we use confidential computing on credit.
So, trust my guess,
as well as the front of the MCCA,
and I guess the attestation interface
will be slushed-absorbed to TPM zero.
That's all, thank you.
Okay.
So, very nice interesting work.
So, I think this is kind of a negotiation
that I just great with you,
that basically you have the close source
components and all that anyway.
So, on the keyboard ones like that,
the conclusion you have,
so this point, the security policies that the vendors
release.
So, I think that's not good components of system,
but on the slide 7,
if you know there is a weak component of the system.
So, there is a point number 2,
you have standard level of attestation,
without the case certificate.
And here the issue is that,
basically you are trusting everyone in the world,
every server in the world that exists,
can now create this attestation.
And it is only secure,
only in every server in the world is secure.
No keys are the,
no code is injected into the custody application environment.
And this is very discreet.
This leads to diversion attack.
We have a paper, which I will just very briefly talk about.
You might have,
but the point in this,
this is,
security must,
you are not,
instead of trusting the cloud provider,
which you have at least regulatory information,
you are trusting everyone in the world,
which is not good.
And I don't think we should take this direction.
Okay.
I have to repeat the question.
So my question is kind of a concern
with this kind of expectations.
Yeah.
You not only trust the cloud provider itself,
you trust everyone in the world through the means of your,
this tool.
That's my concern.
Yeah.
Your question was,
so,
could I have to bend that?
So,
if,
yeah,
if,
we make up,
so, so,
so,
already,
we need,
to,
opera,
certificate,
certificate itself.
So,
so,
standard attestation,
does not include the certificate,
but it can get from,
from homepage.
The difference is,
the difference is,
attestation included,
MPK certificate,
or not.
However,
the,
such certificate can be,
can,
can get from,
uh,
ship you bend us, for example.
Yeah.
So,
uh,
we can discuss something.
Okay.
That's,
uh,
just,
identification.
You say that,
your wood,
uh,
state is mutable,
does it mean that,
you are still in set-up model,
and you can inject new custom keys.
Oh,
okay.
The,
the question is,
uh,
the BM status is changed,
after,
mutable.
Mutable.
Uh,
is it that one?
Yeah.
Mm-hmm.
Uh-hmm.
Okay.
Hmm.
You can samples right,
uh,
you potem Get out of the middle.
Boom.
Uh,
you can set-up,
yeah, yeah, yeah.
Yeah, yeah, yeah.
Okay.
We're great to be EM.
Our greatoo to be EM, right?
and you can do it both when you can create them very much, you can create it through the setup mode, right?
Thank you, thank you.
So on AWS, we can set a secure boot. However, we have to prepare keys for secure boot.
Okay, let's see.
You have a set-plus, like, to get to the conclusion that the VTBM is not drastically good.
If you look at it, it can look at it.
Oh, it's open-not.
Like, I think you have to select this open-not, or you actually have to buy a new VTBM.
Is this right?
Yes, we have VTBM, exactly.
And why come to the conclusion that the VTBM is not structured?
Oh, okay.
The question was VTBM.
So I think this failure is changed.
This figure is wrong.
Let's know as runs on VTBM.
VTBM too.
And open H shape runs on VTBM.
And VTBM 0 is measured and target for remote attestation.
So, we can know the VTBM is used.
However, current status, we don't know the hash barring open HCl.
But open H is the same story, but we know...
Yeah, yeah.
Open H is the same situation.
However, we make...
Oh, open H, we can measure, okay.
I'm sorry, no, we don't have time.
Thank you so much.
Thank you.