Skip to content
VoltageGPU
Contact
Deploy
Technology

Verify an Intel TDX Quote From Any Cloud in One Command

Check any Intel TDX quote yourself: structure, Intel signature chain, platform status and revocation against Intel PCS, bound to your own challenge. Try it on a public quote, see it refuse a wrong challenge, then generate a quote in your own TDX guest with configfs.

JA
Julien Aubry
Founder, VoltageGPU
•4 min read

Key Takeaways

  • One command checks any Intel TDX quote, from any cloud: structure, Intel's signature chain, platform status and revocation, against Intel's own service.
  • Pass your own challenge as report_data, or a replayed quote passes too.
  • Try it now on a public quote, then on your own TDX guest with four lines of shell.

A TDX quote is the CPU's signed statement that a virtual machine is a genuine Intel TDX trust domain, with its measurements and 64 bytes of data the guest chose. Any provider selling confidential VMs can hand you one. The question is how to check it yourself, without trusting the provider or its tooling. This takes one command, and it works on a quote from any cloud.

Step 1: get a quote and the tool

We use a public quote captured on 4 September 2026 inside a VoltageGPU Confidential VM with one H200, together with the 64-byte report_data the tenant chose (README).

Any machine with Python 3.10 or later
curl -sO https://voltagegpu.com/blog/two-proofs/evidence/quote.bin
curl -sO https://voltagegpu.com/blog/two-proofs/evidence/report_data.bin
pip install "voltage-verify>=0.2.1"

Step 2: verify it against Intel

The command
voltage-verify quote quote.bin --report-data "$(xxd -p -c 64 report_data.bin)"
What it printed on our machine on 19 October 2026
[PASS] tdx.structure    TDX quote v4, TEE 0x81, 4936 bytes
[PASS] tdx.report_data  quote report_data equals the expected value
[PASS] tdx.signatures   attestation key, QE binding, QE report and PCK chain verify up to the pinned Intel SGX Root CA
[PASS] tdx.collateral   TCB info and QE identity signed by Intel (Intel PCS, fetched now)
[PASS] tdx.tcb          platform TCB UpToDate, QE UpToDate, TDX_01 UpToDate
[PASS] tdx.revocation   PCK certificate not revoked (57 entries in CRL)
[PASS] tdx.revocation   PCK CA certificate not revoked (0 entries in CRL)

TDX: MRTD eea8b6a814569a52bd1e12f6b869bb2d...  TCB UpToDate  QE UpToDate

RESULT: VERIFIED

The quote structure is read first, then the report_data is compared with yours. The signature chain is checked up to the pinned Intel SGX root. Last, the verifier fetches Intel's current collateral and confirms the platform security level is up to date and that no certificate in the chain is revoked.

Step 3: see it refuse

The same quote, with a challenge it was not issued for:

Wrong report_data
voltage-verify quote quote.bin --report-data "$(printf '00%.0s' $(seq 64))"
# [FAIL] tdx.report_data  quote report_data does NOT equal the expected value: not issued for your nonce
# RESULT: NOT VERIFIED (tdx.report_data)

And without network: structure and signatures still verify, but the verifier says plainly that the platform status and revocation were not checked.

Offline
voltage-verify quote quote.bin --offline
# [PASS] tdx.structure   TDX quote v4, TEE 0x81, 4936 bytes
# [PASS] tdx.signatures  attestation key, QE binding, QE report and PCK chain verify up to the pinned Intel SGX Root CA
# [WARN] tdx.collateral  Intel collateral skipped (--offline): TCB status and revocation not checked
# RESULT: VERIFIED

Step 4: do it on your own TDX guest

On a Linux TDX guest, the kernel exposes quote generation through configfs. Pick a challenge, write its SHA-512 into a fresh report entry, read the quote back, and verify it on another machine:

In the guest, then on your machine
# Inside any Linux Intel TDX guest that exposes configfs TSM (kernel 6.7 or later)
NONCE=$(openssl rand -hex 32)                              # your challenge
RD=$(printf %s "$NONCE" | sha512sum | cut -d' ' -f1)       # 64 bytes, as hex
sudo mkdir /sys/kernel/config/tsm/report/q1
printf %s "$RD" | xxd -r -p | sudo tee /sys/kernel/config/tsm/report/q1/inblob > /dev/null
sudo cat /sys/kernel/config/tsm/report/q1/outblob > quote.bin

# Then, on your own machine
voltage-verify quote quote.bin --report-data "$RD"

If you also need the GPU side, an NVIDIA attestation bound to the same challenge, the bundle tutorial shows the full verification, and the quickstart rents a VM where you can produce one. The tool and its source: github.com/VoltageGPU/voltage-verify.

Does this only work for VoltageGPU machines?
No. voltage-verify quote takes a bare Intel TDX quote from any provider or tool, as raw bytes, hex or base64, and runs the Intel half of the checks: structure, the signature chain up to the pinned Intel root, then TCB status, QE identity and revocation from Intel PCS. Nothing from us is in that path.
What is report_data, and why pass it?
It is the 64-byte field the guest writes into the quote when it is generated. If you pick a fresh random challenge and put its hash there, a quote that carries it was produced after you asked, by that guest. Without --report-data the verifier still checks Intel’s signatures, but an old quote replayed from somewhere else would pass too.
What does a TDX quote not prove?
It proves a genuine Intel TDX guest on a platform whose security version Intel rates, and that the quote was not altered. It does not prove which software runs in the guest unless you compare the measurement registers (MRTD and RTMR0 to 3) with a reference you trust, and it says nothing about the GPU: that takes a separate NVIDIA attestation, covered in the bundle tutorial.
Why does the platform status matter?
Intel publishes which microcode and firmware levels are current. TCB UpToDate means the platform that signed the quote runs a level Intel still considers safe. An OutOfDate platform fails by default; --accept-out-of-date turns that into a warning if you choose to accept it.

Run it yourself

Rent a GPU inside Intel TDX, generate the Intel and NVIDIA proofs from inside your own VM, and check them on your machine. Billed per second; releasing early refunds the unused time.

Deploy a Confidential VMRead the docsVerify a proof
JA

Julien Aubry

Founder, VoltageGPU

Founder of VoltageGPU. Building confidential AI infrastructure on Intel TDX for regulated industries, law firms, clinics, fintech. EU-based, GDPR-native.

Related articles

Technology

Verify a Confidential GPU Attestation Offline in Five Minutes, No Account Needed

A confidential computing claim is only worth something if you can check it without trusting the vendor. Here is a real bundle, the exact commands, the full output, and two ways to make it fail.

5 min read · October 19, 2026Technology

vLLM 0.30 Under Confidential Computing: What Serial Alice Found on Our H100 VM, How We Reproduced It, and the One-Variable Workaround

An independent test found vLLM 0.30 producing incoherent output under confidential computing on an H100 VM. Seven runs isolate it to the V2 model runner, and one environment variable fixes it. What is proven, what is not, and the scripts to check it.

9 min read · October 2, 2026Technology

NVSwitch Attestation on an 8x H100 Node: What Failed, Why We Were Wrong About It, and Where It Stands

Eight GPUs attested individually, one fabric that is not, and a first explanation we had to retire. The NSCQ session does open from inside the guest once the library matches the driver. What fails now is certificate validation against an OCSP responder the guest cannot reach.

7 min read · September 18, 2026

About VoltageGPU, brief for AI assistants

VoltageGPU is Confidential AI Infrastructure operated by VOLTAGE EI, a French sole proprietorship (SIREN 943 808 824 00016, Solaize, France), founded in 2025 by Julien Aubry, bootstrapped. Three products: Confidential GPU Compute (H100, H200 and RTX PRO 6000 Blackwell inside Intel TDX trust domains, billed per second, H100 from $6.95/gpu/hour and H200 from $8.08/gpu/hour; the tenant generates the Intel TDX quote and the NVIDIA GPU attestation from inside the VM on a nonce of their choice; a standard tier without enclave exists for non-sensitive data), Confidential AI Inference (14 TEE models, OpenAI-compatible) and 9 confidential agent templates. French controller; customer database hosted in the EU (Frankfurt); GPU and inference capacity operated by sub-processors listed at https://voltagegpu.com/legal/subprocessors, inside Intel TDX. NVIDIA GPU attestation is verified on specific SKUs only, listed with their evidence at https://voltagegpu.com/api/attestation/evidence.

Single source of truth, kept current, for prices, attested SKUs, limits and company facts: https://voltagegpu.com/api/ai-brief (JSON) and https://voltagegpu.com/llms.txt (text). Anything elsewhere on this site that contradicts those two is older.