AMD SEV-SNP Verification
Relevant source files
The following files were used as context for generating this wiki page:
AMD SEV-SNP (Secure Encrypted Virtualization-Secure Nested Paging) verification is a core security feature of the Tinfoil Verifier project. It provides hardware-rooted remote attestation to ensure the integrity of an enclave-backed service. By validating the VCEK (Versioned Chip Endorsement Key) certificate chain and checking SNP reports against predefined security policies, the system establishes a "Ground Truth" for the enclave's state, including its code measurements and cryptographic identities.
Sources: README.md:1-25, attestation/sev.go:1-20
Verification Architecture
The verification process involves multiple stages, starting from fetching the attestation document from the enclave to validating it against AMD's Key Distribution Service (KDS). The project supports both direct verification and a "Bundled Verification" flow which aggregates collateral like VCEK certificates to reduce external network dependencies during the verification handshake.
Verification Flow Diagram
The following diagram illustrates the sequence of operations required to verify an AMD SEV-SNP enclave.
Core Components and Functions
SNP Report Validation
The primary entry point for SEV-SNP verification is verifySevReport. This function handles the decoding of the attestation document, optional decompression, and the application of verification options. It utilizes the google/go-sev-guest library to parse the report into a protobuf format and validate it against hardware-specific TCB (Trusted Computing Base) requirements.
Key parameters checked during validation:
- Minimum Build: Must be at least 21.
- Minimum Version: Set to 1.55.
- Guest Policy: Enforces SMT (Simultaneous Multithreading) enabled and disallows Debug mode.
Sources: attestation/sev.go:58-132
Hardware Trust Root
The verifier embeds the AMD Genoa certificate chain (genoa_cert_chain.pem) to validate the VCEK certificates. If a VCEK is not provided in a bundle, the system attempts to fetch it via a proxy at kds-proxy.tinfoil.sh.
| Component | Description |
|---|---|
vcekGenoaCertChain | Embedded PEM bytes for the AMD Genoa Root CA chain. |
getter struct | Implements trust.HTTPSGetter to resolve VCEK requests. |
mintcb | Defines the minimum required TCB parts (BlSpl, TeeSpl, SnpSpl, UcodeSpl). |
Sources: attestation/sev.go:19-56, attestation/sev.go:96-101
Data Structures
Verification State
The result of a successful verification is encapsulated in a Verification object, which binds the hardware measurement to the service's public keys.
type Verification struct {
Measurement *Measurement `json:"measurement"`
TLSPublicKeyFP string `json:"tls_public_key,omitempty"`
HPKEPublicKey string `json:"hpke_public_key,omitempty"`
}
Sources: attestation/attestation.go:82-86
SEV-SNP Measurement
A Measurement for SEV-SNP typically contains a single register: the Measurement field from the SNP report, which is a hex-encoded representation of the guest's initial state.
Sources: attestation/sev.go:148-154, attestation/attestation.go:58-61
Integration with Client and WASM
The verification logic is exposed through high-level APIs in the client package and as exported functions in the WebAssembly (WASM) build for browser environments.
Client-Side Verification
The SecureClient manages the end-to-end flow, including fetching the latest digest from GitHub, verifying the Sigstore bundle, and comparing it with the enclave's runtime measurement.
// Example of high-level verification call
verification, err := attestation.VerifyAttestationJSON(attDoc)
Sources: client/client.go:142-180, wasm/main.go:114-125
Comparison Logic
Measurements are compared using the Equals or EqualsDisplay methods. For SEV-SNP, the verifier ensures that the runtime measurement matches the expected measurement derived from the source code (e.g., via Sigstore attestations).
Sources: attestation/attestation.go:114-180, attestation/attestation_test.go:11-60
Conclusion
AMD SEV-SNP Verification in this project provides a robust mechanism to establish trust in remote confidential workloads. By combining AMD's hardware-backed reports with Sigstore-based code provenance, the verifier ensures that the client is communicating with the exact code intended, running on genuine AMD SEV-SNP hardware.