HPKE & EHBP Support

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• attestation/attestation.go
• attestation/cert.go
• attestation/sev.go
• attestation/tdx.go
• wasm/main.go
• examples/verifier/main.go

The Tinfoil Verifier project provides integrated support for Hybrid Public Key Encryption (HPKE) and the Encrypted HTTP Body Protocol (EHBP). This system ensures that communications with enclave-backed services are not only verified through hardware-rooted remote attestation but also secured via end-to-end encryption using attested public keys. By binding encryption keys directly to the hardware attestation report, the system guarantees that only the verified enclave can decrypt sensitive request payloads.

The primary goal of this support is to facilitate secure data exchange with confidential computing environments (AMD SEV-SNP and Intel TDX) where the transport layer (TLS) alone may not provide sufficient end-to-end guarantees if terminated at a load balancer or proxy. EHBP utilizes the HPKE public key discovered during the attestation process to encrypt request bodies before they leave the client.

Sources: README.md:1-20, README.md:105-115

HPKE Key Discovery and Attestation

HPKE public keys are embedded directly within the hardware attestation reports generated by the enclave. During the verification process, the client extracts these keys from the signed hardware report, ensuring the key belongs to the specific, untampered enclave.

Extraction from Hardware Reports

Depending on the platform, the HPKE key is retrieved from specific fields in the attestation document:

• AMD SEV-SNP: The key is extracted from the ReportData field of the SNP report.
• Intel TDX: The key is extracted from the TdQuoteBody.ReportData field of the TDX Quote.

Sources: attestation/sev.go:174-188, attestation/tdx.go:197-268

Data Structure of Verified Keys

When an attestation document is verified, it returns a Verification structure containing the public keys. The hardware report typically contains a concatenated byte slice of the TLS public key fingerprint followed by the HPKE public key.

type Verification struct {
	Measurement    *Measurement `json:"measurement"`
	TLSPublicKeyFP string       `json:"tls_public_key,omitempty"`
	HPKEPublicKey  string       `json:"hpke_public_key,omitempty"`
}

Sources: attestation/attestation.go:88-100

The diagram shows how the system extracts the HPKE public key from raw hardware attestation data.
Sources: attestation/attestation.go:102-108, attestation/sev.go:187, attestation/tdx.go:277

HPKE Binding in Certificates

To provide a secondary layer of validation, the HPKE public key is also embedded into the enclave's TLS certificate using Subject Alternative Names (SANs). The verifier checks that the HPKE key found in the hardware report matches the key advertised in the certificate.

Certificate SAN Encoding

The HPKE key is encoded into DNS names within the SANs using a specific format: NN<base32-chunk>.hpke.<domain>.

• NN: A 2-digit index prefix for multi-chunk keys.
• base32-chunk: The actual key data encoded in Base32.
• hpke: The identifying prefix for the HPKE field.

Sources: attestation/cert.go:106-120

Verification Logic

The VerifyCertificate function performs a cross-check between the certificate SANs and the expected key derived from the attestation document.

Step	Action	Source File
1	Extract SANs containing .hpke.	attestation/cert.go:48
2	Reassemble chunks and decode Base32	attestation/cert.go:121-160
3	Compare decoded key with expectedHPKEKey	attestation/cert.go:61-64

Sources: attestation/cert.go:34-65

EHBP (Encrypted HTTP Body Protocol) Implementation

EHBP is the protocol layer that uses the attested HPKE public keys to encrypt request bodies. In the Tinfoil ecosystem, this is primarily utilized by the JavaScript/TypeScript SDKs and WASM verifiers for end-to-end security in browser and Node.js environments.

WASM Integration

The WASM verifier exposes the HPKE public key to JavaScript environments, allowing frontend applications to perform encryption before sending data to the enclave.

result := map[string]interface{}{
    "tls_public_key":  verification.TLSPublicKeyFP,
    "hpke_public_key": verification.HPKEPublicKey,
    "measurement":     string(jsonMeasurement),
}

Sources: wasm/main.go:123-128

EHBP Workflow

The workflow for EHBP involves discovering the enclave, verifying its hardware attestation, extracting the HPKE key, and then using that key for subsequent encrypted requests.

This sequence illustrates the lifecycle of EHBP, from hardware key discovery to encrypted communication.
Sources: README.md:113-145, wasm/main.go:142-168, attestation/attestation.go:215-230

Technical Specifications

Constants and Identifiers

The system uses specific Predicate Types to identify the version of the attestation and the encryption capabilities.

Predicate Type	Description
https://tinfoil.sh/predicate/sev-snp-guest/v2	SEV-SNP Guest Attestation including HPKE and TLS keys.
https://tinfoil.sh/predicate/tdx-guest/v2	TDX Guest Attestation including HPKE and TLS keys.

Sources: attestation/attestation.go:35-37

Summary of Key Functions

• newVerificationV2: Constructs the verification object by splitting the 64-byte keys slice into TLS Fingerprint (0-32) and HPKE Public Key (32-64).
  • Path: attestation/attestation.go:102-108
• VerifyCertificate: Decodes HPKE keys from SANs and validates them against the attestation document.
  • Path: attestation/cert.go:34
• decodeDomains: Internal helper to handle the chunked Base32 encoding used for embedding keys in DNS SANs.
  • Path: attestation/cert.go:106

Conclusion

The HPKE and EHBP support in the Tinfoil Verifier enables a robust end-to-end security model for confidential computing. By strictly binding encryption keys to hardware-verified measurements and cross-validating them against TLS certificates, the system ensures that sensitive data remains protected throughout its journey from the client to the hardware-protected enclave.