prove that an enclave has been established without alterations of any kind: in other words, remote parties can verify that an application is running inside an SGX enclave. Concretely, remote attestation is used to verify three properties: the identity of the application, that it has not been tampered with, and that it is running securely within an SGX enclave. Remote attestation is carried out in several stages: requesting a remote attestation from the challenger; performing a local attestation of the enclave; converting said local attestation to a remote attestation; returning the remote attestation to the challenger, and the challenger verifying the remote attestation to the Intel Attestation Service.

A detailed technical description is outside of the scope of this paper: detailed descriptions can be found in the standard technical documentation[@cryptoeprint:2016:086; @officialAttestation; @sampleAttestation]. Recent attacks[@vanbulck2018foreshadow] can be used to extract the secret attestation keys used to verify the identity of an SGX enclave, and microcode updates must be installed[@intelL1TF] to prevent their exploitation: that is, it’s essential to check that parties to a remote attestation are using a safe and updated version. However, our protocols are inherently resistant to deniability attacks[@cryptoeprint:2018:424] because they are based on mutual attestation.

As it would 