Attestation Collateral

Relevant source files

The following files were used as context for generating this wiki page:

• attestation/tdx.go
• attestation/sev.go
• attestation/collateral/fetch.sh
• attestation/attestation.go
• client/client.go
• attestation/collateral/pck_crl_platform_chain.txt
• attestation/collateral/tcb_info_00a06d080000.json

Attestation Collateral refers to the set of supporting data, certificates, and revocation lists required to verify the authenticity of hardware-rooted reports from Trusted Execution Environments (TEEs), specifically Intel TDX and AMD SEV-SNP. This collateral establishes a chain of trust from the hardware manufacturer (Intel or AMD) to the specific enclave or Trust Domain (TD) being verified.

The system utilizes both embedded collateral for offline or restricted-network verification and dynamic fetching mechanisms to retrieve platform-specific data like VCEK certificates or TCB (Trusted Computing Base) info. This ensures that the verifier can validate the security versioning and revocation status of the host hardware.

Architecture and Components

The collateral system is divided into platform-specific logic for Intel TDX and AMD SEV-SNP. It includes embedded files, a caching mechanism, and a fetching utility to keep the collateral up to date.

Intel TDX Collateral Structure

Intel TDX verification relies on the Intel Provisioning Certification Service (PCS). The project embeds various JSON and PEM files to facilitate local verification.

Component	File / Variable	Description
Root CA	sgxRootCACertPEM	Intel SGX Provisioning Certification Root CA.
QE Identity	qeIdentityJSON	Identity information for the Quoting Enclave.
TCB Info	tcbInfoCache	A map of TCB information indexed by FMSPC (Family-Model-Stepping-Platform-Custom ID).
CRLs	rootCACRL, pckCRLProcessor	Certificate Revocation Lists for Root and Processor CAs.

Sources: attestation/tdx.go:21-50, attestation/collateral/fetch.sh:13-33

AMD SEV-SNP Collateral

For AMD SEV-SNP, the primary collateral is the Versioned Chip Endorsement Key (VCEK) certificate chain. The project embeds the Genoa certificate chain and provides a mechanism to proxy requests to the AMD Key Distribution Service (KDS).

Sources: attestation/sev.go:21-25, client/client.go:193-197

Data Flow and Fetching

The collateral is managed through a lifecycle of fetching, embedding, and caching to ensure performance and reliability during the verification process.

Automated Fetching Lifecycle

The fetch.sh script automates the retrieval of Intel TDX collateral from Intel's APIs.

The diagram shows the flow of fetching Intel PCS collateral for TDX attestation verification.
Sources: attestation/collateral/fetch.sh:11-45

Internal Caching and Validation

Upon initialization, the TDX module loads embedded TCB information into a cache and performs integrity checks to ensure the data meets the MinimumTcbEvaluationDataNumber.

The sequence diagram illustrates the initialization process where embedded collateral is cached and validated against security version requirements.
Sources: attestation/tdx.go:68-124

Logic and Implementation

TDX Getter Interface

The tdxGetter struct implements a retrieval logic that intercepts requests for Intel PCS URLs and serves the data from the embedded collateral instead of making external network calls.

• Key Function: (t tdxGetter) Get(requestURL string)
• Logic: It parses the URL to determine if the caller is requesting QE Identity, Root CRLs, PCK CRLs, or TCB info based on the fmspc query parameter.

Sources: attestation/tdx.go:132-166

SEV-SNP VCEK Retrieval

AMD SEV-SNP verification can use a pre-provided VCEK in DER format or fetch it via a proxy.

func (*getter) Get(targetURL string) ([]byte, error) {
    // ... logic to handle /vcek/v1/Genoa/cert_chain
    u.Host = "kds-proxy.tinfoil.sh"
    body, _, err := util.Get(u.String())
    return body, err
}

Sources: attestation/sev.go:29-47

Security Constraints

The system enforces strict versioning on collateral to prevent the use of outdated security data.

• Minimum TCB Evaluation: Defined by MinimumTcbEvaluationDataNumber = 18. The build or initialization will panic if embedded collateral is older than this value.
• Intel QE Vendor ID: Hardcoded as 939a7233-f79c-4ca9-940a-0db3957f0607 for validation.

Sources: attestation/tdx.go:56-62, attestation/tdx.go:113-124

Collateral in Single-Request Verification (ATC)

The Bundle structure allows for "Bundled Verification," where all necessary collateral (including the VCEK certificate) is aggregated into a single JSON object. This allows clients to verify an enclave without making multiple round-trips to various hardware provider services.

Field	Description
EnclaveAttestationReport	The raw hardware report (TDX Quote or SEV-SNP Report).
VCEK	Base64 encoded VCEK certificate for AMD platforms.
EnclaveCert	The TLS certificate generated by the enclave.

Sources: attestation/attestation.go:146-154, client/client.go:210-216

Summary

Attestation Collateral serves as the foundation for the hardware-rooted trust model in the project. By combining embedded Intel TDX metadata with dynamic AMD SEV-SNP certificate retrieval, the system ensures that every attestation report is verified against the most recent security standards and revocation data provided by hardware vendors. This collateral is strictly validated during the verifier's initialization to maintain a high security posture.