Intel TDX Verification
Relevant source files
The following files were used as context for generating this wiki page:
Intel Trust Domain Extensions (TDX) verification is a critical component of the Tinfoil Verifier library, providing hardware-rooted remote attestation for Intel-based confidential enclaves. It ensures that the software environment is running within a genuine Intel TDX Trust Domain (TD) and validates the integrity of the enclave's measurements against known good values (Ground Truth).
The verification process involves parsing TDX Quote V4 structures, validating signatures against Intel's Provisioning Certification Service (PCS) collateral, and checking specific security version numbers (SVN) and attributes to ensure a secure Trusted Computing Base (TCB).
Sources: README.md:16-18, attestation/tdx.go:167-180
Architecture and Components
The TDX verification system is built on several layers of trust, moving from the hardware-generated quote to the validation of measurements using embedded or fetched collateral.
Verification Flow
The following diagram illustrates the high-level flow of verifying a TDX attestation document.
The verifier extracts the TDX Quote, validates the signature chain using Intel's Root CA, and ensures the TCB status is acceptable based on embedded collateral.
Sources: attestation/tdx.go:167-190, README.md:52-60
Key Data Structures
The system uses specific structures to represent the enclave's state and the verification results.
| Structure | Description | File Reference |
|---|---|---|
Measurement | Contains the PredicateType (TdxGuestV2) and the list of registers (MRTD and RTMR0-3). | attestation/attestation.go:48-51 |
Verification | Stores the verified Measurement, TLS public key fingerprint, and HPKE public key. | attestation/attestation.go:82-86 |
tdxGetter | Implements the interface to retrieve Intel PCS collateral (CRL, TCB Info, QE Identity). | attestation/tdx.go:61 |
Collateral Management
Intel TDX verification relies on collateral from the Intel Provisioning Certification Service (PCS). This includes TCB Info, Quoting Enclave (QE) Identity, and Certificate Revocation Lists (CRLs).
Embedded Collateral
To ensure offline verification capabilities and prevent accidental use of outdated security data, the project embeds specific collateral files. The build process enforces a MinimumTcbEvaluationDataNumber (set to 18) for all embedded TCB information.
const MinimumTcbEvaluationDataNumber = 18
// IntelQeVendorID is Intel's QE Vendor ID
var IntelQeVendorID = []byte{
0x93, 0x9a, 0x72, 0x33, 0xf7, 0x9c, 0x4c, 0xa9,
0x94, 0x0a, 0x0d, 0xb3, 0x95, 0x7f, 0x06, 0x07,
}
Sources: attestation/tdx.go:50-58, attestation/tdx.go:106-118
Collateral Retrieval Logic
The tdxGetter handles requests for PCS URLs by serving them from an internal cache populated from the collateral/ directory.
Quote Validation and Policy
The core of the verification logic resides in verifyTdxReport, which performs the technical validation of the TDX Quote V4.
Security Policy Constraints
The verifier enforces strict hardware and firmware attributes:
- Minimum TEE TCB SVN: Checked against
0x03, 0x01, 0x02...(3.1.2). - TD Attributes: Must be all zeros except for
SEPT_VE_DISABLE(bit 4). - XFAM (Extended Features Available Mask): Specifically enables features like FP, SSE, AVX, AVX512, PK, and AMX.
- MRSEAM: Must match one of the accepted Intel TDX Module measurements.
Sources: attestation/tdx.go:195-230
Accepted MRSEAM Values
The verifier validates the MrSeam field against known-good Intel TDX module releases:
49b66faa451d19ebbdbe89371b8daf2b65aa3984ec90110343e9e2eec116af08850fa20e3b1aa9a874d77a65380ee7e6685f891ea5c20e8fa27b151bf34bf3b50fbaf7143cc53662727cbdb167c0ad8385f1f6f3571539a91e104a1c96d75e04
Sources: attestation/tdx.go:199-202
Measurement Extraction
Once the quote is validated, the verifier extracts the TDX registers to form a Measurement object for comparison.
TDX Register Mapping
TDX provides five primary measurement registers which are extracted into hex-encoded strings:
| Register Index | TDX Field | Description |
|---|---|---|
| 0 | MrTd | Trust Domain Measurement (Build-time) |
| 1 | Rtmrs[0] | Runtime Measurement Register 0 |
| 2 | Rtmrs[1] | Runtime Measurement Register 1 |
| 3 | Rtmrs[2] | Runtime Measurement Register 2 |
| 4 | Rtmrs[3] | Runtime Measurement Register 3 (Expected to be Zero) |
Sources: attestation/tdx.go:183-191, attestation/attestation.go:10-10
Verification V2 Constructor
The newVerificationV2 function binds the extracted measurements with the public keys found in the ReportData field of the TDX Quote.
func newVerificationV2(measurement *Measurement, keys []byte) *Verification {
return &Verification{
Measurement: measurement,
TLSPublicKeyFP: hex.EncodeToString(keys[:32]),
HPKEPublicKey: hex.EncodeToString(keys[32:]),
}
}
Sources: attestation/attestation.go:88-94
Integration with Client and Verifier
The TDX verification is utilized by the client package and example verifiers to provide an automated end-to-end security check.
Automated Verification Workflow
The examples/verifier/main.go demonstrates how TDX verification is integrated with hardware measurement checks from Sigstore.
- Fetch Runtime Attestation: Retrieves the TDX document from the enclave.
- Verify Quote: Calls
Verify()on the document (leading toverifyTdxAttestationV2). - Hardware Verification: If the format is
TdxGuestV2, it fetches latest hardware measurements from Sigstore and validates theMRTDandRTMR0. - TLS Pinning: Compares the TLS public key fingerprint from the actual connection with the one verified inside the TDX report.
Sources: examples/verifier/main.go:96-126, client/client.go:142-166
Summary
Intel TDX Verification in the Tinfoil project provides a robust mechanism for ensuring the integrity of workloads running on Intel confidential computing hardware. By combining PCS collateral validation, strict policy enforcement (XFAM/Attributes), and integration with Sigstore for hardware measurement tracking, the system ensures that enclaves are both authentic and running the intended, unmodified code.