Cryptographic attestation of data object attributes in a distributed system

A system comprising:

• a memory device;
• and
• a processing device coupled to the memory device, the processing device to perform operations comprising:
• receiving, at a first cluster of secure environments, a request to provide a data object attestation authority certificate to a second cluster of secure environments, the request comprising a cluster certificate of the second cluster issued by a cluster enrollment certificate authority (CA);
• validating the cluster certificate of the second cluster using a public key of the cluster enrollment CA;
• generating an encrypted message comprising the data object attestation authority certificate and a digital signature of the first cluster, wherein the encrypted message is encrypted using a public key indicated in the cluster certificate of the second cluster, and wherein the digital signature of the first cluster is associated with a cluster certificate of the first cluster issued by the cluster enrollment CA;
• and
• providing, to the second cluster, the encrypted message to be decrypted using a private key of the second cluster associated with the cluster certificate of the second cluster, and to be validated using at least the public key of the cluster enrollment CA.

A non-transitory computer-readable medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

• receiving, at a first cluster of secure environments, a request to provide a data object attestation authority certificate to a second cluster of secure environments, the request comprising a cluster certificate of the second cluster issued by a cluster enrollment certificate authority (CA);
• validating the cluster certificate of the second cluster using a public key of the cluster enrollment CA;
• generating an encrypted message comprising the data object attestation authority certificate and a digital signature of the first cluster, wherein the encrypted message is encrypted using a public key indicated in the cluster certificate of the second cluster, and wherein the digital signature of the first cluster is associated with a cluster certificate of the first cluster issued by the cluster enrollment CA;
• and
• providing, to the second cluster, the encrypted message to be decrypted using a private key of the second cluster associated with the cluster certificate of the second cluster, and to be validated using at least the public key of the cluster enrollment CA.