Intra-handshake.fail (CVE-2026-33697 of CVSS 7.5)

1.1. Detailed vulnerability disclosure timeline

• our initial responsible disclosure to vendor: 07 Oct, 2025¶

• acknowledgement by vendor: 14 Dec, 2025¶

• information to IETF: 11 Jan, 2026¶

• public announcement by vendor: 27 Feb, 2026¶

• security advisory issued: 23 March, 2026 {Severity = HIGH (CVSS 7.8)}¶

• CVE (CVE-2026-33697) published: 26 March, 2026 {Severity = HIGH (CVSS 7.5)}¶

1.2. Overview

This draft presents the formal specification and analysis of the candidate binding mechanisms for binding in intra-handshake attestation for standardization for attested TLS protocols:¶

1. Client’s TLS nonce: used in Meta's AI¶

2. Client’s attestation nonce¶

3. Early exporter¶

4. Server’s public key¶

5. Combination of #2 and #3¶

6. Combination of #2 and #4: used in: Edgeless Systems Contrast, Cocos AI, and CCC Attestation SIG's adopted project attested TLS proof of concept¶

7. Combination of #2, #3, and #4: proposed in draft-fossati-tls-attestation-06¶

We provide a formal proof of insecurity of all the above candidate
binding mechanisms of intra-handshake attestation using the
state-of-the-art tool ProVerif and propose a mitigation for the
discovered security vulnerabilities. Our study reveals that it may
not be possible to achieve strong application-traffic (level 3)
binding using intra-handshake attestation alone.

1.3. Affected Implementations

• Meta's AI¶

• Cocos AI¶

• Edgeless Systems Contrast¶

• CCC Attestation SIG's adopted project attested TLS proof of concept¶

1.4. Binding Levels

1. DH shared secret¶

2. Handshake traffic key¶

3. Application traffic key¶

1.5. Correlation Goals

We consider TLS Server as RATS Attester, which is typical in confidential computing.¶

1. Correlation of Evidence to a DH Shared Secret (G1)¶

2. Correlation of Evidence to Client’s Handshake Traffic Key (G2)¶

3. Correlation of Evidence to Client’s Application Traffic Key (G3)¶

1.6. Main results

• All analyzed binding mechanisms and the corresponding implementations of intra-handshake attestation are vulnerable to relay attacks.¶

• Early exporter helps achieve level 1 binding.¶

• Our proposed mechanism helps achieve level 2 binding.¶

• It may not be possible to achieve level 3 in intra-handshake attestation alone without additional assumptions.¶

Given the high-severity vulnerabilities, the developers and maintainers
of intra-handshake attestation MUST urgently move to post-handshake
attestation.

3.1. Tool

We use state-of-the-art symbolic security analysis tool ProVerif for the specification of the protocols.¶

3.2. Modeling

The formal model uses the fixed version of diversion attacks in intra-handshake attestation from our previous work as the starting point to focus on relay attacks in intra-handshake attestation in this work. The rationale is that we consider it more useful to show the added value of this contribution to the community by using the fixed version of diversion attacks in intra-handshake attestation as the baseline, rather than showing the same diversion attacks from ID-Crisis paper, and the discovered CVE ([CVE-2026-33697]) -- which the previous analysis could not find -- practically demonstrates the added value. This modeling choice makes it clear that even with the diversion attacks fixed, high-severity relay attacks would still remain in intra-handshake attestation.¶

3.3. Technical Report

Technical report is available at [Intra-handshake.fail].¶

3.4. Artifacts

Artifacts are available at [Intra-handshake.fail-repo] under Apache-2.0 License.¶

6.1. Normative References

[RFC2119]

Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/rfc/rfc2119>.

[RFC8174]

Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.

6.2. Informative References

[CVE-2026-33697]

CVE, "CoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keys", March 2026, <https://www.cve.org/CVERecord?id=CVE-2026-33697>.

[Intra-handshake.fail]

Sardar, M. U., Dubeyko, V., and J.-M. Jacquet, "Intra-handshake.fail (CVE-2026-33697): High-severity CVE in Attested TLS", September 2026, <https://www.researchgate.net/publication/408219182_Intra-handshakefail_CVE-2026-33697_High-severity_CVE_in_Attested_TLS>.

[Intra-handshake.fail-repo]

Sardar, M. U., Dubeyko, V., and J.-M. Jacquet, "Intra-handshake.fail (CVE-2026-33697): High-severity CVE in Attested TLS", June 2026, <https://github.com/CCC-Attestation/formal-spec-KBS>.