Browser Integration

Relevant source files

The following files were used as context for generating this wiki page:

• wasm/index.html
• README.md
• wasm/main.go
• util/fetch_wasm.go
• attestation/attestation.go

The Browser Integration feature enables remote attestation verification directly within web environments using WebAssembly (WASM). By compiling the Go-based verification logic into a WASM module, the project allows browsers and Node.js environments to verify the integrity of remote enclaves (AMD SEV-SNP and Intel TDX) and validate code provenance via Sigstore integration.

Sources: README.md:12-22, README.md:88-95

Architecture and Components

The browser integration relies on a bridge between the JavaScript runtime and the Go-based verification core. This is achieved through the standard Go WASM bridge (wasm_exec.js) and a dedicated WASM entry point that exports verification functions to the global JavaScript scope.

WASM Bridge Implementation

The system uses syscall/js to expose Go functions to the browser's window object. Key exported functions include verify, verifyEnclave, and verifyCode.

Function	Description
verify(enclave, repo)	Performs end-to-end verification of both the hardware enclave and the software repository.
verifyEnclave(hostname)	Validates the hardware attestation document fetched from a specific enclave.
verifyCode(repo, digest)	Uses Sigstore integration to verify the provenance of the code running in the enclave.

Sources: wasm/main.go:142-148, wasm/index.html:268-271

Data Flow for Browser Verification

The following diagram illustrates the interaction between the User Interface, the WASM module, and external network resources.

The WASM module handles all cryptographic operations, including signature chain verification and measurement comparisons, while the browser provides the networking layer via the Fetch API.
Sources: wasm/main.go:41-55, wasm/main.go:104-118, wasm/index.html:245-265

Network Communication in WASM

Because standard Go net/http calls are restricted in browser WASM environments, the project implements a specialized transport layer using the JavaScript Fetch API to handle binary data and headers properly.

Fetch API Wrapper

The util package contains a WASM-specific implementation of the Get function. It utilizes JavaScript promises and Uint8Array to bridge data between the JS heap and Go memory.

func Get(url string) ([]byte, map[string][]string, error) {
	promise := js.Global().Call("fetch", url)
	result, err := awaitPromise(promise)
    // ... handles ArrayBuffer conversion and header extraction
}

Sources: util/fetch_wasm.go:11-30

Interaction with Enclave Endpoints

The verifier specifically targets the .well-known/tinfoil-attestation endpoint on the enclave host to retrieve hardware-rooted reports.
Sources: wasm/main.go:107-109, attestation/attestation.go:27-27

Implementation Details

Attestation Verification

Verification in the browser supports multiple platform types, defined as PredicateType URIs.

Predicate Type	Platform	Version
https://tinfoil.sh/predicate/sev-snp-guest/v2	AMD SEV-SNP	v2
https://tinfoil.sh/predicate/tdx-guest/v2	Intel TDX	v2
https://tinfoil.sh/predicate/snp-tdx-multiplatform/v1	Multi-platform	v1

Sources: attestation/attestation.go:16-22

Verification Logic Flow

When verify() is called, the WASM module executes the following internal logic:

User Interface Integration

The project provides a reference implementation in wasm/index.html that demonstrates how to load the Go WASM runtime and interact with the verifier.

Loading the Module

1. Include wasm_exec.js.
2. Instantiate the WASM file using WebAssembly.instantiateStreaming.
3. Run the Go instance to initialize global functions.
   Sources: README.md:104-120, wasm/index.html:232-243

Results Handling

Upon successful verification, the module returns a JSON string containing the verified "Ground Truth." This includes:

• tls_public_key: The pinned fingerprint of the enclave's TLS certificate.
• hpke_public_key: The public key for encrypted communications.
• measurement: The verified hardware/software measurements.
  Sources: wasm/main.go:120-125, wasm/index.html:125-131

Conclusion

Browser integration provides a portable, hardware-rooted security layer for web applications. By utilizing WASM, the Tinfoil Verifier ensures that the same rigorous verification logic used in server-side Go environments is available natively in the browser, enabling secure, attested connections to confidential enclaves without relying on a trusted intermediary.