Trusted Roots
Relevant source files
The following files were used as context for generating this wiki page:
Trusted Roots in the Tinfoil Verifier project represent the foundational cryptographic anchors used to verify the integrity and authenticity of remote attestations and code provenance. The system relies on a combination of hardware-specific roots (Intel SGX/TDX and AMD SEV-SNP) and software supply chain roots (Sigstore/Rekor). These roots allow the client to establish a chain of trust from the hardware manufacturing level up to the specific build of the software running in an enclave.
Sources: README.md:92-102, sigstore/sigstore.go:27-46
Sigstore Trusted Root
The Sigstore trusted root is a JSON-formatted configuration that defines the public keys and certificate authorities (CAs) used to verify software attestations. It includes details for Transparency Logs (Rekor), Certificate Authorities (Fulcio), and Timestamp Authorities.
Components of the Sigstore Trusted Root
The configuration is structured to support multiple transparency logs and CAs, ensuring redundancy and versioning for cryptographic material.
| Component | Description |
|---|---|
tlogs | Transparency log configurations including base URLs and ECDSA/Ed25519 public keys for Rekor. |
certificateAuthorities | Chains of trust for Fulcio, including root and intermediate certificates. |
ctlogs | Certificate Transparency logs used for verifying certificate issuance. |
timestampAuthorities | Authorities used to provide verifiable timestamps for signatures. |
Sources: client/trusted_root.json:1-124
Management and Retrieval
The project includes automated utilities to keep the Sigstore trusted root up to date.
- FetchTrustRoot: A function that uses the Sigstore TUF (The Update Framework) client to retrieve the latest
trusted_root.jsonfrom official Sigstore repositories. - rootfetch utility: A standalone tool that executes the fetch and saves the result to a local file, typically used during build processes via
go:generate. - Embedded Root: The
clientpackage embeds a known-good version of the trusted root to ensure offline verification capabilities.
Sources: rootfetch/main.go:19-32, sigstore/sigstore.go:50-62, client/client.go:17-18
Hardware Trusted Roots
Hardware roots are used to verify the identity and TCB (Trusted Computing Base) status of the physical CPU and its security features. These are platform-specific and often involve certificate chains provided by the silicon vendor.
Intel TDX Roots
Intel TDX verification relies on the Intel SGX Provisioning Certification Service (PCS). The verifier embeds specific collateral to avoid runtime dependencies on Intel's APIs during critical verification steps.
The diagram above shows the hierarchy of Intel-provided certificates used to verify TDX quotes.
Key hardware anchors for Intel include:
- SGX Root CA: The top-level certificate (embedded as
sgx_root_ca.pem). - TCB Evaluation Data: A minimum version (currently 18) is enforced to prevent the use of outdated or insecure hardware collateral.
- Intel QE Vendor ID: A fixed UUID (
939a7233-f79c-4ca9-940a-0db3957f0607) used to identify valid Quoting Enclaves.
Sources: attestation/tdx.go:27-30, attestation/tdx.go:68-83, attestation/tdx.go:121-140
AMD SEV-SNP Roots
AMD verification utilizes the Versioned Chip Endorsement Key (VCEK) certificate chain.
- Genoa Certificate Chain: The verifier embeds the
genoa_cert_chain.pemfetched from AMD's Key Delivery Service (KDS). - KDS Proxy: While the root is embedded, the system can fetch specific VCEK certificates via a proxy (
kds-proxy.tinfoil.sh) to verify individual enclaves.
Sources: attestation/sev.go:21-23, attestation/sev.go:37-45
Trust Flow in Verification
The verification process integrates both hardware and software roots to produce a "Ground Truth" for the enclave.
This sequence illustrates how both roots are consulted during a standard verification lifecycle.
The logic for this integration is primarily handled in client.go, where the sigstoreClient is initialized with the trusted root JSON before verifying GitHub-sourced attestations.
Sources: client/client.go:125-160, sigstore/sigstore.go:64-106, wasm/main.go:42-83
Summary
Trusted Roots form the cryptographic backbone of the Tinfoil Verifier. By combining supply-chain trust (Sigstore) with hardware-level trust (Intel/AMD), the system ensures that an enclave is not only running on genuine secure hardware but is also executing the exact, unmodified code version specified by the user's repository. These roots are managed through a combination of static embedding for reliability and dynamic fetching for long-term security updates.