Attestation Flow

KMS self-attestation and public verification via Intel Trust Authority

Two Attestation Paths

The system supports two attestation paths: (1) KMS self-attestation via POST /attest, used by nodes during Plane 1 verification and by the public verifier; and (2) public verification via the Attestation Verifier web app, which chains the KMS attestation through Intel Trust Authority for independent validation.

/attest
KMS self-attestation
/api/verify
public verification

KMS Self-Attestation

The POST /attest endpoint lets any caller obtain a fresh TDX quote from the KMS. This is the foundational building block for both node verification (Plane 1) and the public attestation verifier.

Request

POST /attest
Content-Type: application/json

{
  "nonce": "hex-encoded-bytes" // caller-provided freshness nonce
}

Response

200 OK
Content-Type: application/json

{
  "quote": "base64-encoded-tdx-quote" // raw TDX quote from dstack
}

Internal Flow

Caller mero-kms-phala dstack POST /attest { nonce } hash(nonce || binding) get_quote(report_data) TDX driver raw TDX quote { quote }

Report Data Construction

The KMS constructs report_data = SHA256(nonce || binding_data) before requesting the quote from dstack. The binding_data may include additional context (e.g., KMS version). The caller can verify the nonce is included in the quote’s report_data to confirm freshness.

Public Attestation Verifier

The attestation verifier is a public web application that allows anyone to verify a KMS instance is running inside a genuine TDX enclave. It chains the KMS’s self-attestation through Intel Trust Authority for independent verification.

Full Verification Flow

Browser /api/verify KMS /attest Intel Trust Authority POST { kmsUrl, binding } 1 gen nonce POST /attest { nonce } 2 dstack quote { quote } 3 attest(quote, nonce) 4 verify quote sign JWT attestation JWT 5 validate JWT extract claims verification results 6 render results
Browser
Verifier API
KMS
Intel Trust Authority

Verification Details

What the Verifier Checks

Quote Authenticity

Intel Trust Authority cryptographically verifies the TDX quote was produced by genuine Intel TDX hardware. The ITA signature on the returned JWT is the trust anchor.

Freshness

The verifier generates a fresh nonce for each request. The nonce appears in the quote’s report_data, proving the attestation was produced for this specific verification session.

Measurements

The JWT contains MRTD, RTMR0–3 values. The verifier displays these for manual comparison against known-good values published in release notes.

TCB Status

The JWT includes the TCB (Trusted Computing Base) status: UpToDate, SWHardeningNeeded, OutOfDate, etc. This indicates the platform’s security patch level.

JWT Claims Displayed

{
  "attester_tcb_status": "UpToDate",
  "attester_type": "TDX",
  "tdx_mrtd": "a1b2c3...",
  "tdx_rtmr0": "d4e5f6...",
  "tdx_rtmr1": "...",
  "tdx_rtmr2": "...",
  "tdx_rtmr3": "...",
  "tdx_report_data": "...",
  "advisory_ids": ["INTEL-SA-..."],
  "iat": 1700000000,
  "exp": 1700003600
}

Architecture

Frontend

React single-page application. User inputs a KMS URL and optional binding data. Results are displayed in a structured, readable format with color-coded status indicators.

React TypeScript

Backend

Serverless API function (/api/verify). Handles nonce generation, KMS communication, ITA integration, and JWT validation. Stateless — no database required.

serverless TypeScript

Node Usage (Plane 1)

When a merod node boots, it uses the same POST /attest endpoint to verify the KMS before requesting its storage key. The flow is simpler than the public verifier — the node performs its own quote verification without going through ITA.

1

Generate Nonce

The node generates a random nonce locally.

2

Call POST /attest

Send the nonce to the KMS. Receive the raw TDX quote.

3

Verify Quote Locally

The node verifies the TDX quote signature, checks report_data contains the nonce, and compares MRTD against known-good KMS measurements embedded in its configuration.

4

Proceed to Key Release

If verification passes, the node proceeds with the challenge/get-key flow.