Bootstrapping Mutual Attestation with Kleene's Second Recursion Theorem

Abstract: Mutual attestation among nodes with no central trusted operator requires each node to hold reference values (expected code measurements) for its peers. The naïve approach of mutually embedding these reference values in the nodes' code leads to an infinite regress. We call the problem of resolving this infinite regress the reference-value bootstrapping problem for mutual attestation. Existing solutions avoid this regress by relying on a trusted third party (TTP), externally supplied reference values, or architecture-specific measurement mechanisms. We instead express the bootstrapping problem as a system of mutual fixed-point equations and solve it by Kleene's second recursion theorem. The construction produces nodes that mutually reference one another's code and reconstruct every peer's exact source from built-in data alone. When a deployed source file is measured directly, as with a Python script, a node obtains the peer's reference value by applying the measurement function directly to the reconstructed source. When a built image is measured, as with AWS Nitro Enclaves, a node instead reproducibly rebuilds the peer's image from the reconstructed source and derives its reference measurement. For the first case, we develop PyReflect, a Python transpiler, and use it to implement a TPM mutual-attestation PoC. For the second, we develop NixReflect, a Nix transpiler, and use it in a PoC in which two Nitro Enclaves reproduce each other's reference PCRs from built-in data alone. Our solution is architecture-independent, requires neither a TTP nor externally supplied reference values, and works with existing attestation stacks unchanged.

• The paper provides a transpiler using Kleene's Theorem for solving mutual attestation problems in decentralised systems, generating self-contained, mutually referencing nodes without need for a trusted third party (TTP) or externally provided reference values.
• Two Proof-of-Concept (PoC) implementations—PyReflect for TPM systems, and NixReflect for AWS Nitro Enclaves—successfully conduct TPM mutual attestation and reproduce reference values without a TTP, confirming the general applicability of the proposed methodology.
• The proposed methodology costs approximately 100 times more than direct hashing due to the record-breaking operation but remains practical, with results available in seconds after a node's cold launch.

The reference-value bootstrapping problem

In the IETF RATS architecture, a Verifier checks an Attester's signed evidence against a reference value supplied by a Reference Value Provider. When several attestable nodes must verify one another—decentralised confidential-computing platforms, multi-enclave applications such as Decent, or agentic AI systems with mutually distrustful component providers—each node must hold its peers' reference values before any exchange. Hard-coding these values fails: node $A$'s code would embed $B$'s measurement, which is a digest of $B$'s code embedding $A$'s measurement, and so on. The paper names this circularity the reference-value bootstrapping problem and observes that existing resolutions all pay a price: trusted third parties (AWS's Measurement Notary Service, Teaclave's auditors), externally configured authorisation lists (DECENT), architecture-specific report fields outside the measured scope (KSS on SGX CONFIG_ID, TDX MR_CONFIG_ID, SEV-SNP HOST_DATA), or measurement-specific derivations requiring modified SDKs (MAGE).

The paper's central claim is that none of these are necessary: the bootstrapping problem is exactly a system of mutual fixed-point equations, solvable by Kleene's second recursion theorem, yielding nodes that reconstruct every peer's exact source from built-in data alone and derive reference values without any external party.

Fixed points via the simultaneous recursion theorem

Nodes are modelled under three assumptions: each node is identified with the Gödel number of its source $e_i$ computing $\varphi_{e_i}$ under an acceptable numbering $\varphi$; node $i$'s intended behaviour is a computable partial function $f_i(\vec{e}, {-})$ of the whole family's sources; and measurement is a deterministic computable function of source. A mutually attesting family is then a tuple solving $\varphi_{e_i} = f_i(e_1,\dots,e_k, {-})$. By the simultaneous form of Kleene's theorem—a corollary derived from the single-node case via the computable isomorphism $B$0—such a solution always exists and is computable uniformly from indices of the $B$1. The uniformity clause is the constructive content: it yields a transpiler mapping any template of behaviours into a genuinely mutually referencing family, so the solution is generated automatically rather than hand-written.

Assumptions (i) and (ii) are benign for any Turing-complete language; assumption (iii)—that measurement is a computable function of source—is substantive, and its realisation splits by what the architecture measures.

Source-measured architectures: PyReflect and TPM attestation

When the architecture hashes deployed code directly (Linux IMA being canonical, interpreted deployments generally), the source-to-measurement map is a single hash. PyReflect, a Python transpiler, implements the construction: it serialises the whole template family into one canonical data blob shared verbatim by all emitted files, plus a per-node selector line—the same reduction that derives the simultaneous corollary from the single-node theorem. Occurrences of peer node-ids in bodies are rewritten to calls to a run-time reconstruction function that reassembles any member's file byte-for-byte, regenerating the single line the blob cannot contain (its own embedding) in the manner of a quine program.

A two-node proof of concept performs full TPM mutual attestation using swtpm emulators driven through tpm2-pytss: ECDH key exchange, fresh nonces, PCR extension of the node's own digest, and AK-signed quotes whose qualifying data binds the quote to the session. Each verifier replays the expected PCR from the self-computed reference value alone. Two simplifications are conceded explicitly: swtpm provides no hardware-backed identity (AK–EK binding is omitted), and PCR 23 is userland-extendable, so nothing ties the extended hash to running code; production deployments should use IMA/PCR 10 and TEE-isolated vTPMs or physical TPMs. These concern authentication of the TPM, not the feasibility question studied.

Artifact-measured architectures: NixReflect and Nitro Enclaves

Most TEE measurements cover build artifacts—SGX MRENCLAVE, CVM launch digests, container image digests, Nitro Enclaves PCR0–2—so the reference value has the form $B$2, where the build procedure $B$3 is not in general deterministic. Assumption (iii) is then realised through reproducible builds: a node must rebuild its peer's artifact bit-for-bit over all measurement-relevant contents before applying $B$4.

NixReflect applies the same rewriting mechanism to Nix expressions, whose pinned closures carry the toolchain, dependencies, and sources needed for step (2'). The bundled proof of concept runs two AWS Nitro Enclaves that, at run time and from built-in data alone, reconstruct each other's enclave definition, reproducibly rebuild each other's EIF via monzo/aws-nitro-util (the stock nitro-cli pipeline is not reproducible), and compute PCR0–2 matching the deployed images—verified end-to-end on both x86_64 and AArch64 hosts. This resolves, without a TTP, precisely the bootstrapping problem AWS addresses with a Measurement Notary. The PoC deliberately stops at deriving reference values rather than reimplementing Nitro attestation itself; composing the reproduced values with the standard hypervisor attestation flow yields mutual attestation.

Cost

Transpilation output size is $B$5; a 0.9 KB two-node template yields 3.4 KB nodes. Run-time derivation cost was isolated on a Graviton2 m6g.xlarge host with identical per-enclave allocations (2 vCPUs, 2 GiB), comparing a digest-only variant against the rebuild variant across 10 runs per node:

Metric	digest	rebuild
Derivation (node 1 / node 2)	0.069 s / 0.064 s	6.853 s / 6.839 s
Launch → result (node 1 / node 2)	1.554 s / 1.429 s	8.415 s / 8.524 s

Rebuilding is approximately $B$6 slower than hashing alone, though absolute cost remains modest (under ten seconds cold-launch-to-reference-PCRs). Because rebuilding traverses the workload's full build closure, the gap is expected to widen for complex applications, which also raises memory pressure—an effect motivating the offloading variant below.

Trust assumptions

The construction changes exactly one RATS role: it relocates the Reference Value Provider into the verifying node. The threat model is inherited wholesale from the underlying one-way attestation flow—isolation architecture, measurement mechanism, and Endorser certificates—and the guarantee belongs to each verifier individually: compromising other group members cannot make an uncompromised node accept code the underlying flow would reject, since passing off different code requires a second preimage against the architecture's measurement hash. The paper is explicit that the contribution demonstrates feasibility of self-contained reference-value reconstruction only; it neither prevents out-of-model attacks nor enables protocol-level attacks the model rules out.

Discussion: offloading builds and update granularity

For artifact-measured nodes, the dominant overhead is carrying a full toolchain and paying run-time build cost. An alternative uses attestable builds: a Build TEE issues confidential-computing proofs binding measurements to source snapshots ahead of time; nodes verify the proof against their reconstructed source and adopt the bound measurement. This removes toolchain and latency while remaining TTP-free in the relevant sense—a forged pair is simply rejected—but requires trust in the Build TEE's hardware root and endorsement PKI when it differs from the deployed nodes' roots (e.g., an SEV-SNP build TEE for Nitro nodes adds trust in AMD's chain). Revocation and transparency for build proofs remain open.

Updates currently propagate globally because the shared blob records every body verbatim. A dependency-graph decomposition resolving fixed points per strongly connected component in reverse topological order could confine redeployment to affected components—no new theory is required—but fully mutual attestation is the worst case, as its reference graph is strongly connected.

Relation to prior approaches

Compared with TTP-based schemes (AWS's notary, Teaclave's auditors), the construction eliminates the external authority entirely. Compared with DECENT's self-attestation certificates, it does not take peer measurements as deployment inputs but derives them internally, and is architecture-independent where DECENT relies on SGX certificate hierarchies. Compared with hardware-rooted injection (KSS, TDX/SNP launch fields), it needs no injection field or cooperating launch path, though those schemes avoid carrying peer sources and permit per-launch policy variation. Compared with MAGE—which stores pre-measurement hash states in a reserved section and exploits the incremental structure of MRENCLAVE, requiring SDK, signing-tool, and loader modifications—the paper's construction operates at the source level for any computable measurement function with no modification to the TEE stack. Structurally, MAGE's shared-section-plus-index layout is a measurement-level analogue of the blob-plus-selector design here. Scalability topologies (gossip à la Careful Whisper, designated attesters) are orthogonal and compose with the construction.

Limitations and open questions

The paper concedes several boundaries plainly. The PoCs stop short of complete production flows: no hardware-rooted TPM identity, userland-extendable PCRs, and Nitro enclaves that announce rather than cryptographically consume reference values. Reproducible-build realisations inherit the fragility of reproducibility itself—any nondeterminism in $B$7 breaks assumption (iii). The run-time build cost grows with the workload closure and may exceed enclave memory budgets. Update propagation is currently global for mutual families. Whether attestable-build offloading can be integrated without expanding the verifier's trust set beyond the deployed nodes' own roots, and how build-proof revocation should work, are left open.

Conclusion

The paper recasts reference-value bootstrapping for mutual attestation as a system of mutual fixed-point equations and solves it constructively via Kleene's second recursion theorem, yielding transpilers (PyReflect, NixReflect) that generate self-contained, mutually referencing nodes for both source-measured and artifact-measured architectures. Demonstrations on TPM machinery and AWS Nitro Enclaves establish feasibility without a TTP, external reference values, or modifications to existing attestation stacks, at the cost of a roughly $B$8 derivation slowdown when reproducible rebuilding intervenes. The guarantee is strictly inherited from the underlying one-way attestation flow; the contribution is confined to eliminating the external Reference Value Provider.