Custom Attestation Providers

Relevant source files

The following files were used as context for generating this wiki page:

• attestation/provider.go
• attestation/attestation.go
• attestation/sev.go
• attestation/tdx.go
• client/client.go

Custom Attestation Providers in the Tinfoil Verifier project allow for the extension and standardization of how remote attestation documents are requested and verified across different hardware platforms. This system abstracts the complexities of hardware-specific protocols, such as AMD SEV-SNP and Intel TDX, into a unified interface for consumers.

The architecture is designed to bind hardware-rooted trust to high-level application security, specifically facilitating secure HTTP communication and TLS certificate pinning based on verified enclave measurements.

Core Provider Interface

The project defines a universal interface for requesting attestation documents. This abstraction allows different implementations to handle the specific requirements of the underlying Trusted Execution Environment (TEE).

The Provider Interface

The Provider interface is the primary extension point for integrating new attestation mechanisms.

type Provider interface {
    RequestAttestation(userData []byte) (*Document, error)
}

Sources: attestation/provider.go:4-6

Method	Parameter	Return Type	Description
RequestAttestation	userData []byte	(*Document, error)	Requests a new attestation document, optionally embedding user-provided data (like public keys) into the report.

Sources: attestation/provider.go:4-6

Attestation Document Structure

All providers must yield a standardized Document that encapsulates the platform-specific attestation data.

Data Structures

The Document struct represents the raw attestation report received from a provider. It includes a format identifier to route the document to the correct verification logic.

type Document struct {
    Format PredicateType `json:"format"`
    Body   string        `json:"body"`
}

Sources: attestation/attestation.go:215-218

Supported Predicate Types

Providers use specific PredicateType values to identify the hardware platform and versioning of the attestation data:

• SevGuestV2: https://tinfoil.sh/predicate/sev-snp-guest/v2
• TdxGuestV2: https://tinfoil.sh/predicate/tdx-guest/v2

Sources: attestation/attestation.go:22-26

Platform Implementations

The project currently provides logic for two primary hardware-rooted providers: AMD SEV-SNP and Intel TDX.

AMD SEV-SNP Provider

The SEV-SNP implementation utilizes VCEK (Versioned Chip Endorsement Key) certificates and SNP report validation. It specifically targets the Genoa product line.

The diagram above shows the flow for verifying an AMD SEV-SNP report.
Sources: attestation/sev.go:47-90, attestation/sev.go:126-130

Intel TDX Provider

The TDX provider handles Quote V4 validation. It includes embedded collateral such as QE Identity, Root CA CRLs, and TCB Info to ensure the verifier can operate with minimal external dependencies.

The sequence shows how the TDX provider utilizes embedded collateral for offline-capable verification.
Sources: attestation/tdx.go:193-247

Verification Logic

Once a provider generates a Document, it is passed to the Verify() method. This method acts as a dispatcher based on the document's format.

Verification Flow

This diagram illustrates the internal routing of verification requests based on platform format.
Sources: attestation/attestation.go:241-251

The verification process results in a Verification object containing the extracted measurements and public key fingerprints:

Field	Type	Description
Measurement	*Measurement	Contains the hardware registers (e.g., MRTD, RTMRs).
TLSPublicKeyFP	string	The SHA-256 fingerprint of the enclave's TLS public key.
HPKEPublicKey	string	The fingerprint of the enclave's HPKE public key.

Sources: attestation/attestation.go:68-72

Integration with Secure Clients

Providers are utilized by the SecureClient to establish "Ground Truth." The client fetches the attestation document via a well-known endpoint (/.well-known/tinfoil-attestation) and verifies it against expected code measurements.

Verification and Comparison

The Measurement.Equals function is used to compare the runtime measurements produced by a provider against the expected measurements (source measurements) fetched from GitHub/Sigstore.

func (m *Measurement) Equals(other *Measurement) error {
    _, err := m.EqualsDisplay(other)
    return err
}

Sources: attestation/attestation.go:181-184, client/client.go:142-160

Conclusion

Custom Attestation Providers enable the project to support diverse confidential computing environments by abstracting platform-specific attestation logic. By implementing the Provider interface and defining appropriate PredicateType handlers, developers can extend the verifier to support new hardware or custom attestation schemes while maintaining compatibility with the project's secure HTTP client and measurement comparison systems.