Introduction to Tinfoil Verifier

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• attestation/attestation.go
• attestation/sev.go
• attestation/tdx.go
• client/client.go (Referenced via client/client_test.go)
• wasm/main.go
• sigstore/sigstore.go (Referenced via examples/verifier/main.go)

Tinfoil Verifier is a portable Go library and secure HTTP client designed for hardware-rooted remote attestation of enclave-backed services. It enables clients to verify the integrity and code provenance of remote enclaves, specifically supporting AMD SEV-SNP and Intel TDX platforms, and binds this verification to TLS connections via certificate pinning.

The system provides a self-contained verification mechanism that does not rely on external attestation services during the core verification loop. It integrates with Sigstore for code provenance and offers multiple deployment options, including a WebAssembly (WASM) build for browser environments and Swift bindings for mobile integration.

Sources: README.md:1-25, attestation/attestation.go:34-40

Core Architecture and Attestation Flow

The architecture centers on the verification of hardware-generated reports against known trust roots. The process typically involves fetching an attestation document from a well-known endpoint on the enclave, validating the hardware signature chain, and comparing the runtime measurements against reference measurements derived from source code.

Verification Sequence

The following diagram illustrates the high-level flow of remote attestation within the system.

Key Components

Component	Description	Relevant Files
Secure Client	A wrapper around http.Client that performs automatic attestation and TLS pinning.	client/client.go
Attestation Module	Handles platform-specific logic for parsing and validating AMD and Intel hardware reports.	attestation/sev.go, attestation/tdx.go
Sigstore Integration	Verifies code provenance using Rekor bundles to ensure the enclave is running authorized code.	sigstore/sigstore.go, examples/verifier/main.go
WASM Verifier	A WebAssembly port of the Go logic for client-side verification in browsers.	wasm/main.go, wasm/index.html

Sources: README.md:15-30, README.md:148-160

Platform Support

Tinfoil Verifier supports two primary Confidential Computing (CC) architectures. Each platform uses a specific PredicateType to identify the attestation format and measurement structure.

Supported Predicate Types

Predicate Type	Platform	Description
https://tinfoil.sh/predicate/sev-snp-guest/v2	AMD SEV-SNP	Includes TLS key fingerprint and SNP measurement.
https://tinfoil.sh/predicate/tdx-guest/v2	Intel TDX	Includes TDX quote validation and TD report checks.
https://tinfoil.sh/predicate/snp-tdx-multi-platform/v1	Multi-Platform	A unified format for comparing measurements across different hardware.

Sources: attestation/attestation.go:17-26, README.md:110-116

Hardware-Specific Logic

• AMD SEV-SNP: Utilizes VCEK certificates and validates the SNP report against the AMD KDS (Key Delivery Service). It checks the guest policy, including SMT and Debug settings. Sources: attestation/sev.go:48-135
• Intel TDX: Validates QuoteV4 documents using Intel's SGX/TDX Root CA. It verifies TCB (Trusted Computing Base) levels and checks specific registers such as MRTD and RTMRs (0-3). Sources: attestation/tdx.go:183-250

Data Models and Verification Logic

Measurement Structure

The Measurement struct is the primary data structure for representing enclave state. It contains the platform type and a slice of hardware registers.

type Measurement struct {
    Type      PredicateType `json:"type"`
    Registers []string      `json:"registers"`
}

Sources: attestation/attestation.go:42-45

Measurement Comparison

The EqualsDisplay and Equals functions implement the logic for comparing runtime measurements against source-derived "ground truth." This includes handling multi-platform measurements where a single source measurement might be compared against either an AMD or Intel runtime.

Secure HTTP Client Integration

The client package provides a SecureClient that automates the attestation process. Upon the first request, the client:

1. Retrieves the enclave's attestation document.
2. Verifies the document and extracts the expected TLS certificate fingerprint.
3. Pins the fingerprint for all subsequent TLS connections in that session.

tinfoilClient := client.NewSecureClient("enclave.example.com", "org/repo")
resp, err := tinfoilClient.Get("/api/data", nil)

Sources: README.md:38-50, client/integration_test.go:76-85

Bundled Verification (ATC)

To reduce latency, the system supports "Bundled Verification" via Tinfoil ATC (Air Traffic Control). This allows a client to fetch all necessary verification data—hardware reports, VCEK certificates, and Sigstore bundles—in a single JSON response.

• Endpoint: https://atc.tinfoil.sh/attestation
• Functions: VerifyFromATCJSON, VerifyFromBundle

Sources: README.md:120-135, attestation/attestation.go:303-315, client/client_test.go:84-100

Conclusion

Tinfoil Verifier provides a robust, developer-friendly implementation of remote attestation. By abstracting the complexities of AMD SEV-SNP and Intel TDX hardware reports and integrating directly with standard Go HTTP clients and WASM, it enables secure, verified communication with confidential enclaves across diverse environments.