Attestation

During launch, the TEE hardware computes a cryptographic hash—called an enclave measurement or MRENCLAVE—over the initial code, data, and configuration loaded into the secure memory. This hash serves as a unique, unforgeable identity fingerprint. Any modification to the code, even a single bit, produces a completely different hash, making tampering immediately detectable.

Attestation relies on a Hardware Root of Trust—a physically embedded, immutable cryptographic key fused into the silicon during manufacturing. This key signs the attestation report, proving the evidence originated from genuine hardware. The chain of trust flows upward:

• Immutable ROM verifies firmware
• Firmware verifies the TEE environment
• TEE verifies the application code

Remote attestation allows a third party (a relying party or client) to verify a TEE over a network before sending secrets. The process:

1. The TEE generates a Quote—a signed report containing the measurement hash and platform state
2. The verifier validates the signature against the hardware manufacturer's public key
3. The verifier compares the measurement against a known-good reference value
4. Only on success are secrets (decryption keys, credentials) released

Major cloud providers and silicon vendors operate attestation services that act as trusted third parties to simplify verification:

• Intel SGX: Intel DCAP (Data Center Attestation Primitives) provides a flexible, on-premises verification service
• AMD SEV-SNP: AMD provides a Key Distribution Service (KDS) for certificate retrieval
• AWS Nitro Enclaves: The Nitro Security Module signs attestation documents locally, eliminating external dependencies
• Azure: Hosts an Attestation Service that validates TEE evidence before releasing keys from Azure Key Vault

To prevent replay attacks—where an attacker captures a valid attestation report and replays it later—attestation protocols include freshness mechanisms:

• Nonce: A random challenge provided by the verifier that must be included in the signed Quote, binding it to a specific session
• Timestamps: Hardware-generated timestamps prove the report was generated recently
• Ephemeral Keys: The TEE generates a fresh public-private key pair for each attestation, ensuring forward secrecy

In AI workloads, attestation protects both model weights and user data:

• Model Provenance Attestation: Proves a specific model (identified by its hash) is loaded, preventing model substitution attacks
• GPU Attestation: Extends verification to accelerators like NVIDIA H100, confirming the GPU firmware and configuration are trusted before offloading computation
• Confidential RAG: Ensures the retrieval pipeline and LLM inference both run inside attested enclaves, protecting the user's query and the retrieved context from the infrastructure provider

A cryptographic hash of the initial code, data, and configuration loaded into a TEE. This measurement serves as a unique identity fingerprint. During attestation, the measurement is compared against a known-good reference value to detect tampering.

• Computed over the enclave's initial state before execution
• Includes the application binary, libraries, and security flags
• Any modification, even a single byte, produces a completely different hash
• Stored in hardware-protected registers during runtime

The process by which a TEE proves its identity and integrity to a remote relying party. The enclave generates a Quote—a cryptographically signed report containing its measurement—which is verified against the hardware manufacturer's attestation service.

• Enclave sends a Quote to the challenger
• Challenger verifies the signature against the manufacturer's certificate chain
• Ensures the enclave is running on genuine, up-to-date hardware
• Establishes a secure channel only after successful verification

The immutable foundation of the attestation chain, typically a fused key burned into the silicon during manufacturing. This root key is inaccessible to software and anchors all subsequent cryptographic operations.

• Derives platform-specific keys used to sign attestation reports
• Compromising the root would break the entire trust model
• Physically unclonable and resistant to extraction attacks
• Forms the basis for SevSnpReport and SGX Quote verification

The process of cryptographically verifying the identity and firmware integrity of a GPU before offloading sensitive AI computation. NVIDIA Confidential Computing extends attestation to the GPU, ensuring the accelerator is genuine and operating in a trusted mode.

• Verifies the GPU's unique identity and firmware hash
• Ensures the GPU is in a confidential computing mode with memory encryption active
• Prevents data exfiltration through compromised or counterfeit accelerators
• Critical for Confidential Inference and multi-party AI training

A Confidential KMS releases decryption keys only after successful attestation. This binds secrets to a specific enclave identity, ensuring that only verified, untampered code can access sensitive data.

• Keys are wrapped with a policy requiring a valid attestation token
• Prevents a compromised host OS from extracting plaintext secrets
• Enables secure model weight distribution for Confidential AI
• Integrates with tools like HashiCorp Vault and cloud-native KMS offerings