Closed Jonas-Metzger closed 3 years ago
In debug mode, PCRs that are related to the image (0, 1, 2 and 8) are set to zero, to protect data that should only be accesible in production mode.
Interesting, thanks for clarifying! Makes sense, anyone seeing nonzero PCRs can be assured that the enclave runs in non-debug mode. What I still wonder is which security concerns the debug mode introduces. Is there a general explainer of the differences between debug and production mode that I should be aware of?
Hi @petreeftime. For some reason most PCR measurements in the attestation document are zero.
This must be a bug, right? The
nitro-cli build-enclave --docker-uri ${DOCKER_IMAGE_NAME} --output-file ${EIF_FILE}
command outputs correct PCR0-PCR2 values upon completion.Below is the Rust code executing the request: