Verification Flow

The Verification Flow is the core mechanism within the Tinfoil Verifier project used to establish trust in remote enclaves (AMD SEV-SNP and Intel TDX). It ensures that a client is communicating with a genuine hardware-protected environment running specific, untampered code. This process involves hardware-rooted remote attestation, verification of code provenance via Sigstore, and binding these identities to the TLS layer for secure communication.

Sources: README.md:9-14, client/client.go:142-212

High-Level Process Overview

The verification flow can be performed either through a standard multi-step process or an optimized single-request "Bundled Verification" flow via an Air Traffic Control (ATC) service.

Standard Verification Sequence

The standard sequence involves fetching reference measurements (Ground Truth) from a trusted source (GitHub/Sigstore) and comparing them against runtime measurements fetched directly from the enclave.

Core Components and Logic

1. Attestation Document Verification

The system supports two primary hardware platforms, each with specific validation logic defined in the attestation package.

For Intel TDX, the flow includes validating the MrSeam, TdAttributes, and Xfam fields against accepted hardware policies. For AMD SEV-SNP, it validates the report against the Versioned Chip Endorsement Key (VCEK) certificate chain.

Sources: attestation/sev.go:58-132, attestation/tdx.go:193-274

2. Code Provenance via Sigstore

The verifier uses Sigstore to ensure the code running in the enclave matches a specific GitHub repository state. The sigstore package fetches an attestation bundle and verifies it against a trusted_root.json.

• Function: VerifyAttestation in sigstore/sigstore.go
• Logic: Decodes the Sigstore bundle, verifies the transparency log entry, and extracts the snp_measurement or tdx_measurement (RTMRs) from the DSSE envelope.

Sources: sigstore/sigstore.go:122-177, client/client.go:146-168

3. Measurement Comparison

Trust is established when the "Source" (reference) measurements match the "Runtime" (enclave) measurements.

The system uses SnpTdxMultiPlatformV1 predicates to allow cross-platform comparison, mapping SNP measurements to TDX RTMRs where applicable.

Sources: attestation/attestation.go:94-177, client/client.go:192-212

Bundled Verification Flow

To reduce latency and complexity for clients (especially in WASM/browser environments), the project supports a "Bundled" flow where a proxy (ATC) aggregates all necessary evidence.

Bundle Structure

A Bundle contains all the components required for a single-pass verification without external network calls during the validation step.

Sources: attestation/attestation.go:203-210, client/client.go:214-266

Security Binding (TLS Pinning)

After the measurements are verified, the Verification object contains a TLSPublicKeyFP (fingerprint). This fingerprint is used to initialize a TLSBoundRoundTripper. This ensures that every subsequent HTTP request made by the SecureClient is pinned to the specific public key generated inside the verified enclave, preventing Man-in-the-Middle (MitM) attacks.

Sources: client/client.go:269-281, attestation/attestation.go:286-302

Conclusion

The Verification Flow integrates hardware-level security reports with software-level provenance (Sigstore) and network-level security (TLS). By comparing cryptographic digests of the running environment against signed assertions from the build system, the Tinfoil Verifier provides a complete chain of trust from the hardware up to the application layer.

Sources: README.md:144-151, client/client.go:142-212