You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
// - Operators should fetch the latest collateral from PCS to ensure the EK validity starts close to the current time.
73
+
// - Operators should fetch the latest collateral from Intel Provisioning Certification Service (PCS) to ensure the EK validity starts close to the current time.
74
74
// - When the EK expires and the TCB evaluation data number has been updated, operators might not be immediately ready
75
75
// to operate with the newly accepted TCB status, resulting in availability risks.
76
76
// To mitigate this risk, operators should set an appropriate `tcb_evaluation_data_number_update_grace_period`.
@@ -103,7 +103,7 @@ message ClientState {
103
103
// If this field is empty, operator signatures are not required, allowing any entity to act as an operator.
104
104
//
105
105
// Operational assumptions:
106
-
// - At least one operator (incl. actors not included in `operators`) is expected to promptly reference and report the latest TCB evaluation data number.
106
+
// - At least one operator (including entities not listed in the `operators` field) is expected to promptly reference and report the latest TCB evaluation data number.
107
107
// - If no operator promptly reports the latest TCB number, the client continues accepting attestations based on outdated collateral for up to 12 months.
108
108
// - Not all operators may immediately prepare an SGX environment compatible with the latest TCB level.
109
109
// - The `tcb_evaluation_data_number_update_grace_period` ensures that all operators have a guaranteed minimum period to update their SGX environments, maintaining overall availability.
@@ -123,21 +123,18 @@ message ClientState {
123
123
// The client only accepts the zkDCAP output generated using collateral with a TCB evaluation data number equal to or greater than this number.
124
124
uint32current_tcb_evaluation_data_number=11;
125
125
126
-
// The grace period for updating to the latest TCB evaluation data number (in seconds)
126
+
// The grace period (in seconds) for operators to update their SGX environments to support a newly observed TCB evaluation data number.
127
127
//
128
128
// Notes:
129
129
// - A shorter grace period could increase availability risk if operators are not given sufficient time
130
130
// to prepare the new SGX environment compatible with the updated TCB level.
131
131
// - Conversely, a longer grace period could delay the adoption of the latest TCB level, potentially increasing security risks.
132
132
// - Operators must carefully consider their operational preparation needs and security posture when configuring this value.
133
133
//
134
-
// Relationship among `tcb_evaluation_data_number_update_grace_period`,
135
-
// `next_tcb_evaluation_data_number`, and `next_tcb_evaluation_data_number_update_time`:
136
-
//
137
-
// When a new TCB evaluation data number greater than the current one is observed:
134
+
// When a new TCB evaluation data number greater than the current number is observed:
138
135
//
139
136
// - If the grace period is zero:
140
-
// - The current TCB evaluation data number is updated immediately.
137
+
// - The current number is updated immediately.
141
138
//
142
139
// - If the grace period is non-zero:
143
140
// - The new number is reserved as `next_tcb_evaluation_data_number`.
@@ -153,8 +150,8 @@ message ClientState {
153
150
// - Immediate activation of newly observed number, preserving the reserved next number.
154
151
//
155
152
// These edge cases can occur due to excessively long grace periods or frequent TCB Recovery Events occurring within shorter intervals than the typical 6-month update frequency.
156
-
// However, since we assume that the operators can prepare for non-latest TCB, the practical availability impact of these edge cases is considered limited.
157
-
// In addition, given a well-configured grace period aligned with typical TCB update intervals, the client will never skip the grace period for the each TCB number.
153
+
// Note that we assume operators can maintain an appropriate TCB status based on previous TCB collateral. Therefore, we expect that immediate updates in these edge cases do not cause operational issues.
154
+
// Additionally, with a well-configured grace period aligned with typical TCB update intervals, the client will never skip the configured grace period for any TCB number update.
/// - Operators should fetch the latest collateral from PCS to ensure the EK validity starts close to the current time.
85
+
/// - Operators should fetch the latest collateral from Intel Provisioning Certification Service (PCS) to ensure the EK validity starts close to the current time.
86
86
/// - When the EK expires and the TCB evaluation data number has been updated, operators might not be immediately ready
87
87
/// to operate with the newly accepted TCB status, resulting in availability risks.
88
88
/// To mitigate this risk, operators should set an appropriate `tcb_evaluation_data_number_update_grace_period`.
@@ -117,7 +117,7 @@ pub struct ClientState {
117
117
/// If this field is empty, operator signatures are not required, allowing any entity to act as an operator.
118
118
///
119
119
/// Operational assumptions:
120
-
/// - At least one operator (incl. actors not included in `operators`) is expected to promptly reference and report the latest TCB evaluation data number.
120
+
/// - At least one operator (including entities not listed in the `operators` field) is expected to promptly reference and report the latest TCB evaluation data number.
121
121
/// - If no operator promptly reports the latest TCB number, the client continues accepting attestations based on outdated collateral for up to 12 months.
122
122
/// - Not all operators may immediately prepare an SGX environment compatible with the latest TCB level.
123
123
/// - The `tcb_evaluation_data_number_update_grace_period` ensures that all operators have a guaranteed minimum period to update their SGX environments, maintaining overall availability.
@@ -137,21 +137,18 @@ pub struct ClientState {
137
137
/// The client only accepts the zkDCAP output generated using collateral with a TCB evaluation data number equal to or greater than this number.
138
138
#[prost(uint32, tag = "11")]
139
139
pubcurrent_tcb_evaluation_data_number:u32,
140
-
/// The grace period for updating to the latest TCB evaluation data number (in seconds)
140
+
/// The grace period (in seconds) for operators to update their SGX environments to support a newly observed TCB evaluation data number.
141
141
///
142
142
/// Notes:
143
143
/// - A shorter grace period could increase availability risk if operators are not given sufficient time
144
144
/// to prepare the new SGX environment compatible with the updated TCB level.
145
145
/// - Conversely, a longer grace period could delay the adoption of the latest TCB level, potentially increasing security risks.
146
146
/// - Operators must carefully consider their operational preparation needs and security posture when configuring this value.
147
147
///
148
-
/// Relationship among `tcb_evaluation_data_number_update_grace_period`,
149
-
/// `next_tcb_evaluation_data_number`, and `next_tcb_evaluation_data_number_update_time`:
150
-
///
151
-
/// When a new TCB evaluation data number greater than the current one is observed:
148
+
/// When a new TCB evaluation data number greater than the current number is observed:
152
149
///
153
150
/// - If the grace period is zero:
154
-
/// - The current TCB evaluation data number is updated immediately.
151
+
/// - The current number is updated immediately.
155
152
///
156
153
/// - If the grace period is non-zero:
157
154
/// - The new number is reserved as `next_tcb_evaluation_data_number`.
@@ -167,8 +164,8 @@ pub struct ClientState {
167
164
/// - Immediate activation of newly observed number, preserving the reserved next number.
168
165
///
169
166
/// These edge cases can occur due to excessively long grace periods or frequent TCB Recovery Events occurring within shorter intervals than the typical 6-month update frequency.
170
-
/// However, since we assume that the operators can prepare for non-latest TCB, the practical availability impact of these edge cases is considered limited.
171
-
/// In addition, given a well-configured grace period aligned with typical TCB update intervals, the client will never skip the grace period for the each TCB number.
167
+
/// Note that we assume operators can maintain an appropriate TCB status based on previous TCB collateral. Therefore, we expect that immediate updates in these edge cases do not cause operational issues.
168
+
/// Additionally, with a well-configured grace period aligned with typical TCB update intervals, the client will never skip the configured grace period for any TCB number update.
0 commit comments