]> TU Dresden, Germany

muhammad_usama.sardar@tu-dresden.de

agent2agent AI agents Intra-handshake attestation CVE-2026-33697 The draft aims to provide technical details of CVE-2026-33697, which is substantial technical evidence of how intra-handshake attestation fails in practice. About This Document The latest revision of this draft can be found at . Status information for this document may be found at . Source for this draft and an issue tracker can be found at .

Introduction We responsibly disclosed the vulnerability in intra-handshake attestation -- as noted in security advisory issued -- to the vendors, which resulted in CVE () of CVSS 7.5.

Detailed vulnerability disclosure timeline

• our initial responsible disclosure to vendor: 07 Oct, 2025
• acknowledgement by vendor: 14 Dec, 2025
• information to IETF: 11 Jan, 2026
• public announcement by vendor: 27 Feb, 2026
• security advisory issued: 23 March, 2026 {Severity = HIGH (CVSS 7.8)}
• CVE (CVE-2026-33697) published: 26 March, 2026 {Severity = HIGH (CVSS 7.5)}

Comparison with other vulnerabilities in confidential computing literature

• wiretap.fail: No CVE (Intel and AMD announcements)
• TEE.fail: No CVE
• TDXdown: CVSS 2.5 by Intel
• Staleus: CVE-2025-54509: CVSS 4.0
• BreakFAST: CVE-2025-61972: CVSS 4.2 and CVE-2025-61971: CVSS 5.9
• BadRAM: CVSS 5.3 by AMD
• Fabricked: CVE-2025-54510: CVSS 5.9

The comparison of the above with CVSS 7.5 for indicates that attested TLS is not mature yet compared to the rest of the confidential computing stack, and is currently one of the weakest links in the ecosystem. Further formal analysis of production implementation of intra-handshake attestation has led to discovery of another class of attacks and will potentially lead to three CVEs (currently under responsible disclosure) each with an expected CVSS 9.1.

Overview This draft presents the formal specification and analysis of the candidate binding mechanisms for binding in intra-handshake attestation for standardization for attested TLS protocols:

1. Client’s TLS nonce: used in Meta's AI
2. Client’s attestation nonce
3. Early exporter
4. Server’s public key
5. Combination of #2 and #3
6. Combination of #2 and #4: used in: Edgeless Systems Contrast, Cocos AI, and CCC Attestation SIG's adopted project attested TLS proof of concept
7. Combination of #2, #3, and #4: proposed in draft-fossati-tls-attestation-06

Affected Implementations

• Meta's AI
• Cocos AI
• Edgeless Systems Contrast
• CCC Attestation SIG's adopted project attested TLS proof of concept

Binding Levels

1. DH shared secret
2. Handshake traffic key
3. Application traffic key

Correlation Goals We consider TLS Server as RATS Attester, which is typical in confidential computing.

1. Correlation of Evidence to a DH Shared Secret (G1)
2. Correlation of Evidence to Client’s Handshake Traffic Key (G2)
3. Correlation of Evidence to Client’s Application Traffic Key (G3)

Main results

• All analyzed binding mechanisms and the corresponding implementations of intra-handshake attestation are vulnerable to relay attacks.
• Early exporter helps achieve level 1 binding.
• Our proposed mechanism helps achieve level 2 binding.
• It may not be possible to achieve level 3 in intra-handshake attestation alone without additional assumptions.

Property	Mechanism #1,2,4,6	Mechanism #3,5,7	Proposed mechanism
G1 : Correlation of Evidence to gxy	❌	✅	✅
G2 : Correlation of Evidence to kch	❌	❌	✅
G3 : Correlation of Evidence to kc	❌	❌	❌

Implications of Research for IETF SEAT WG

• We believe post-handshake attestation alone, such as draft-fossati-seat-expat, can achieve level 3 binding.
• The research suggests that recent hybrid proposals (combination of intra-handshake attestation and post-handshake attestation) draft-fossati-seat-early-attestation and draft-ritz-seat-facts may add unnecessary complexity of intra-handshake attestation without adding any security benefit compared to post-handshake attestation alone, such as draft-fossati-seat-expat.

Implications of Research for IETF TLS WG

• Remote attestation within the handshake is very dangerous, since to our knowledge, it is one of the highest scored vulnerabilities in confidential computing literature (see this).

Implications of Research for Agent2Agent Intra-handshake attestation does more damage than protection for AI agents.

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Technical Details

Tool We use state-of-the-art symbolic security analysis tool ProVerif for the specification of the protocols.

Modeling The formal model uses the fixed version of diversion attacks in intra-handshake attestation from our previous work as the starting point to focus on relay attacks in intra-handshake attestation in this work. The rationale is that we consider it more useful to show the added value of this contribution to the community by using the fixed version of diversion attacks in intra-handshake attestation as the baseline, rather than showing the same diversion attacks from ID-Crisis paper, and the discovered CVE () -- which the previous analysis could not find -- practically demonstrates the added value. This modeling choice makes it clear that even with the diversion attacks fixed, high-severity relay attacks would still remain in intra-handshake attestation.

Technical Report Technical report is available at .

Artifacts Artifacts are available at under Apache-2.0 License.

Security Considerations All of this document is about the insecurity of intra-handshake attestation.

IANA Considerations This document has no IANA actions.

References Normative References In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. Informative References CVE

Acknowledgments We would like to thank our co-authors of paper for their valuable contributions:

• Viacheslav Dubeyko
• Jean-Marie Jacquet

We gratefully acknowledge the following for insightful discussions on this work:

• Eric Rescorla
• Juho Forsén
• Markus Rudy
• Mariam Moustafa
• Bruno Blanchet
• Steve Kremer
• Tjaden Hess
• Martin Thomson
• Yuning Jiang
• Pavel Nikonorov
• Casey Wilson
• Danko Miladinovic
• Songbo Bu
• Nathanael Ritz

We also gratefully acknowledge the following who gave feedback on previous state-of-the-art that we utilize as the basis:

• Tuomas Aura
• Ionut Mihalcea
• Thomas Fossati
• Hannes Tschofenig
• Yaron Sheffer
• Laurence Lundblade
• Giridhar Mandyam
• Christopher Patton
• Jonathan Hoyland
• Richard Barnes

Several others at the IETF, IRTF, and CCC have contributed by providing feedback. We sincerely thank Karthikeyan Bhargavan, Bruno Blanchet, and Nadim Kobeissi for the foundational formal model of draft 20 of TLS 1.3 in their work.