VoltageGPU, Confidential VM (single-GPU H200, Intel TDX), attestation artifacts
Captured on 4 September 2026 from inside a tenant VM, over SSH, as root.
Article: https://voltagegpu.com/blog/two-proofs-tdx-nvidia-h200-attestation-tenant
Guide:   https://docs.voltagegpu.com/pods/confidential-vm

These are raw files, unchanged since capture. Checksums are in SHA256SUMS.
Two separate attestation rounds were run that day, a few minutes apart. Each
round is verifiable on its own. They do NOT share a nonce, so do not expect the
GPU report below to hash to the digest quoted inside the NVIDIA token.

------------------------------------------------------------------------------
Round A, NVIDIA Remote Attestation Service (nras_token.json, 3,055 bytes)
------------------------------------------------------------------------------
Produced by the NVIDIA nv-attestation-sdk on the VM. The SDK drew its own
32-byte nonce, fetched the GPU evidence, sent it to
https://nras.attestation.nvidia.com and stored the reply.

The file is a JSON array. Element 1 holds "REMOTE_GPU_CLAIMS": a JWT signed by
NVIDIA (ES384, kid nv-eat-kid-prod-...). Decode its payload and you will find:
  iss                                   https://nras.attestation.nvidia.com
  x-nvidia-overall-att-result           true
  eat_nonce                             6154dbb21ed4bf90d79e4464aa5ea4c2cf4dbc7e1a814a13c0a131c0bb598d05
  iat                                   1788525065  (2026-09-04T12:31:05Z)
The per-GPU JWT under "GPU-0" carries the detail: hwmodel GH100, driver
595.71.05, VBIOS 96.00.CF.00.02, secboot true, dbgstat disabled, measres
success, nonce-match true, signature verified, cert chain validated.

Verify it without trusting us: fetch NVIDIA's JWKS at
https://nras.attestation.nvidia.com/.well-known/jwks.json, check the ES384
signature of both JWTs with any JWT library, then read the claims. The
signature proves NVIDIA issued these claims for that GPU at that time. It does
not prove which company operates the machine; only a fresh run on your own VM
does that.

------------------------------------------------------------------------------
Round B, raw GPU report (gpu_report.bin, 4,129 bytes; nonce.txt)
------------------------------------------------------------------------------
Fetched a few minutes later with a second, self-chosen nonce, using the
NVIDIA attestation tooling directly, to show the report layout.
  nonce (32 bytes, hex)  420662604bc726e1fc010ae10997d1ff60153bbe712d6ec0431e35f2ac404c11
  where it sits          bytes 4..36 of gpu_report.bin (see nonce.txt)
The SPDM responder appends 32 random bytes of its own, so two reports on the
same GPU never match byte for byte (guide, section "report stability").
This raw report was not submitted to NRAS and the GPU certificate chain is not
included here, so its signature cannot be checked offline from this folder
alone. Round A is the file to verify; Round B is the file to read.

------------------------------------------------------------------------------
Intel TDX quote (quote.bin, 5,243 bytes; report_data.bin, 64 bytes)
------------------------------------------------------------------------------
Generated by the tenant through the kernel configfs TSM interface
(/sys/kernel/config/tsm/report), same VM, same day. The quote is a version 4
TD quote (header bytes 04 00 02 00 81 00: version 4, ECDSA-P384 attestation
key, TEE type 0x81 = TDX). report_data.bin is the 64-byte value the tenant
chose; it appears verbatim in the quote at byte offset 568.

Verify offline with Intel's DCAP quote verification library (QVL) or any
independent TDX quote verifier, against Intel's root CA. Check the PCK
certificate chain, the QE identity, the TCB level, then confirm that bytes
568..632 equal report_data.bin. VoltageGPU is not in that trust chain.

------------------------------------------------------------------------------
What this folder proves, and what it does not
------------------------------------------------------------------------------
Proves: on 4 September 2026 a tenant of this service obtained, from inside
their own Intel TDX VM, an NVIDIA-signed statement that an H200 in
confidential-computing mode passed remote attestation, and a signed TDX quote
bound to a report_data of their choosing.
Does not prove: anything about a VM you have not attested yourself. Rent one,
run the five commands in the guide, verify your own files.

Independent reproduction: Mohammed Zoheb Shaik (Custodian, a key broker for
model weights) repeated both proofs from his own tenant VM on 6 September 2026
and reported that NVIDIA's service agreed with his local verifier on every
claim. Cited with his permission; his report itself is not redistributed.