Enclave measurement

When an enclave starts, the hardware hashes the image it loads and records the result in a register (PCR0 is the register for the whole image). The value goes into every attestation document. It's a fingerprint: the same image always gives the same value, and any change, however small, gives a different one.

A measurement is only meaningful if you know which code produces it. That's the job of a reproducible build: anyone with the source can rebuild the image and get the same measurement.

On Valtu

Each enclave release publishes its measurement. Secrets are released to an enclave only when its image matches. The production keys' public halves are compiled into the image, so the measurement covers them too. The current measurement and release are listed in the security docs, and any attestation from production can be checked against them.