Checked by VoltageGPU · 6 November 2026

Attestation verifiedIntel TDX + NVIDIA confidential computing

An Intel TDX quote, generated inside an Intel TDX trust domain, and NVIDIA GPU attestation tokens, both carrying a hash of the same workload manifest. VoltageGPU checked the quote's signature chain up to Intel's root and the tokens' signatures up to NVIDIA's attestation service. You can check them again yourself, offline, with the commands below.

Download the bundle Re-verify it yourself

Attested: 2026-11-06 14:08:01 UTC; time signed by NVIDIA
GPU: 1 × GH100; NVIDIA Hopper (GH100), model signed by NVIDIA
CPU trust domain: Intel TDX; quote v4, chained to the Intel SGX Root CA
Intel TCB: UpToDate; per Intel, 6 November 2026

§ 01 / checked by VoltageGPU

What we verified, line by line

Run on 2026-11-06 14:08:33 UTC by voltagegpu-verified/1: checks named as in voltage-verify, run on the Intel collateral stored in the bundle, with the TCB status and the revocation lists judged at the time NVIDIA signed. Each line says what passing means and what the code saw.

Bundle

Manifest commitmentsmanifest.commitments
SHA-256 and SHA-512 of the workload manifest are recomputed and match the bundle (bookkeeping; the binding itself is checked below).
SHA-256 and SHA-512 of the canonical manifest equal the commitments recorded in the bundle

Intel TDX

TDX quote structuretdx.structure
The quote is an Intel TDX quote, version 4, TEE type 0x81, with an ECDSA P-256 attestation key and a PCK certificate chain.
TDX quote v4, TEE type 0x81, 4936 bytes
Quote bound to the manifesttdx.report_data
The 64-byte report_data inside the quote is the SHA-512 of the manifest, so the quote was requested with this manifest and its challenge.
quote report_data equals SHA-512 of the manifest
Trust domain not in debug modetdx.debug
The TD attributes signed in the quote say debug is off: the host cannot read the trust domain’s memory through the debug interface.
TDATTRIBUTES.DEBUG is 0
Intel signature chaintdx.signatures
The attestation key signs the quote, the Quoting Enclave vouches for that key, and the platform certificate chains to the Intel SGX Root CA we pin.
attestation key, QE binding, QE report and PCK chain verify up to the pinned Intel SGX Root CA
Intel collateraltdx.collateral
The TCB info and Quoting Enclave identity carried in the bundle are signed by Intel’s SGX TCB Signing certificate, which chains to the same pinned root and is not on Intel’s revocation list.
TCB info and QE identity are signed by Intel's SGX TCB Signing certificate, chained to the pinned Intel SGX Root CA and not revoked; fields read from the signed bytes only
Platform TCB leveltdx.tcb
By Intel’s TCB info and QE identity, both valid at the NVIDIA-signed attestation time, the platform firmware, the TDX module and the Quoting Enclave were at a level Intel rates UpToDate (or SWHardeningNeeded).
platform TCB UpToDate, QE UpToDate, TDX_01 UpToDate, per Intel TCB info issued 2026-11-06
Revocationtdx.revocation
Intel’s revocation lists, signed by their issuers and valid at the attestation time, do not list the platform certificate or its CA.
PCK certificate not revoked (57 entries in Intel's PCK CRL), PCK CA not revoked (0 entries in the root CRL), both CRLs valid at attestation time

NVIDIA GPU

NVIDIA signaturesnvidia.signatures
NVIDIA’s Remote Attestation Service signed the GPU tokens, with keys carried in the bundle whose certificates chain to an NVIDIA Attestation Service intermediate (pinned by us, or served by NVIDIA’s own key endpoint), so the downloaded bundle verifies offline with the same keys.
2 NVIDIA-signed tokens verify (ES384, issuer NRAS) with keys carried in the bundle, certificates chained to the pinned NVIDIA Attestation Service intermediate
GPU attestation bound to the manifestnvidia.nonce
The nonce NVIDIA signed is the SHA-256 of the same manifest, so the GPU attestation was requested with the same manifest and challenge as the TDX quote. The two proofs are tied together only through that manifest hash.
NRAS eat_nonce equals SHA-256 of the manifest, in the verifier token and every GPU token
GPU tokens belong to this attestationnvidia.binding
Every per-GPU token is the exact one NVIDIA’s summary token names by digest: none was swapped in from another session or left out.
each GPU token is the one NVIDIA's verifier token names (SHA-256 digest in submods), 1 GPU(s)
GPU claimsnvidia.policy
NVIDIA reports, for every GPU: measurements match NVIDIA’s reference values, secure boot on, debug disabled, nonce matched, report signature and certificate chain valid.
overall result true; every GPU: measurements success, secure boot on, debug disabled, nonce matched, report signature and certificate chain validated by NVIDIA
Token issued with the bundlenvidia.freshness
NVIDIA issued its token after the creation time declared in the manifest, within 24 hours of it, and not in the future.
NVIDIA token issued 2s after the time declared in the manifest

§ 02 / re-verify it yourself

Do not take our word for it

The trust chain ends at Intel and NVIDIA, not at VoltageGPU. These commands run on your machine.

Get the tool and this exact bundle
voltage-verify is open source (MIT, Python 3.10+). The bundle is the file these checks ran on; compare its SHA-256 with the one printed at the bottom of this page.
Shell
```
pip install "voltage-verify>=0.3.0"
curl -fsSL -o bundle.json https://voltagegpu.com/verified/4Fwya1hNkUSyzOxJDC0isw/bundle.json
sha256sum bundle.json
```
Every check, on your machine, against Intel today
Re-runs the checks above. Intel's TCB info, Quoting Enclave identity and revocation lists are fetched from Intel now. NVIDIA's public keys come from the bundle, and each signing key must chain to an NVIDIA Attestation Service intermediate pinned in the tool. The tdx.measurements warning says the TD software is not pinned (last step).
Shell
```
voltage-verify verify bundle.json --challenge 3c8e94b8d2be58ce6339f6385740197fe6d62bffe26b73c6c984f3c50e8c8eb9 --hwmodel GH100 --gpus 1
```
The same checks with no network
Uses the Intel collateral stored in the bundle at attestation time. --accept-offline-tcb accepts that the TCB status and the revocation lists come from that copy; without it the result reads VERIFIED (TCB and revocation from the bundle's Intel collateral, not checked against Intel today), with exit code 3. The copy must be at most 30 days old: for an older bundle the failure prints the value to pass to --max-collateral-age.
Shell
```
voltage-verify verify bundle.json --offline --accept-offline-tcb --challenge 3c8e94b8d2be58ce6339f6385740197fe6d62bffe26b73c6c984f3c50e8c8eb9 --hwmodel GH100 --gpus 1
```

Intel's verdict today

We rated the platform with Intel's TCB info embedded at attestation time. This asks Intel's servers now: signature chain, current TCB status, Quoting Enclave identity and revocation, with the quote still bound to this manifest through its report_data.

Shell

python3 -c "import json,base64;s=json.load(open('bundle.json'))['tdx']['quote_b64'];open('quote.bin','wb').write(base64.b64decode(s+'='*(-len(s)%4)))"
voltage-verify quote quote.bin --report-data cc2d0c7dd317a14fd2743af0d420e43e4c535d7d4c002c99fc958b768b2c7dd21776bc5096107cff7ef2d788c21d7280b8ab043d476d471180a6ee7fb25fb747

Watch it fail when it should
Ten tampered copies must each be rejected: three manifest changes (image, artifact, another field), a replayed challenge, one byte of the quote, one claim in a GPU token, a GPU token copied under another name, tokens re-signed with an attacker key, a duplicated key id and a stripped certificate chain in the bundle JWKS.
Shell
```
voltage-verify selftest bundle.json --challenge 3c8e94b8d2be58ce6339f6385740197fe6d62bffe26b73c6c984f3c50e8c8eb9
```
That the challenge is yours
Only whoever generated the challenge knows it was fresh. If you asked for this proof, check that the challenge above is the one you issued: a replayed bundle carries someone else's.
That the measurements are the VM image you trust
MRTD and RTMR0 to RTMR3 measure the initial VM state and boot chain. Whether they match a reference image is a policy decision we do not make for you: voltage-verify compares them only with the values you pass to --expect-mrtd and --expect-rtmr0 to --expect-rtmr3.

§ 03 / limits

What this page does not prove

That the trust domain and the GPU are the same machine. The Intel quote and the NVIDIA tokens are tied to each other only through the manifest hash they both carry.
That the GPU executed the image or model named in the manifest. Both proofs carry a hash of a description of the workload, not of the code that ran; that needs a measured launcher.
Which company operated the machine. The proofs come from Intel and NVIDIA hardware and name no cloud provider.
Who uploaded this page, or who wrote the manifest. Its free-text fields are user-provided; their hash is in both proofs, so a copied bundle still carries its original text and challenge.

§ 04 / Intel TDX

Measurements and platform status

Read from the signed TD report inside the quote.

MRTD: eea8b6a814569a52bd1e12f6b869bb2d9c0c8a7a43e658ffc3b42c199f116157ea7f04d359c7fdfd8ac483152cc13542initial contents of the trust domain (firmware image)
RTMR0: 7a15ca5d3b2b5132347a552586a1c3ee53b6b5acd7c1c0e2e175adc0018058326416389ef31faa3b99669e2fbe36acfetypically firmware configuration
RTMR1: 965b54adf526d37237906189a31d9b058c39fac8909d9689e3340505aac4176deed2c2f3374b226304b23137d4832ae9typically boot loader and kernel
RTMR2: 82031b4c7c4d70565122917f25a978b623ccf8e0894db8d8f44c93716f094f5bdb871eebc6fc97e27ea41f0627107466typically kernel command line and initrd
RTMR3: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000free for the workload to extend
MRSEAM: 7bf063280e94fb051f5dd7b1fc59ce9aac42bb961df8d44b709c9b0ff87a7b4df648657ba6d1189589feab1d5a3c9a9dthe Intel TDX module
REPORTDATA: cc2d0c7dd317a14fd2743af0d420e43e4c535d7d4c002c99fc958b768b2c7dd21776bc5096107cff7ef2d788c21d7280b8ab043d476d471180a6ee7fb25fb747SHA-512 of the manifest
TDATTRIBUTES: 0000001000000000debug off
XFAM: e702060000000000
TEE_TCB_SVN: 0b010400000000000000000000000000
FMSPC: b0c06f000000Intel platform family
Quote: v4, TEE type 0x81, 4936 bytes

Platform TCB: UpToDateTCB level of 2025-08-13
Quoting Enclave: UpToDate
TDX module: TDX_01 UpToDate
Intel TCB info: issued 2026-11-06 13:36:55 UTCembedded in the bundle at attestation time, signed by Intel

§ 05 / NVIDIA

GPU attestation claims

Signed by NVIDIA, 2026-11-06 14:08:01 UTC
GPU	Model	Driver	VBIOS	Measurements	Secure boot	Debug
GPU-0	NVIDIA Hopper (GH100)	595.71.05	96.00.CF.00.01	success	on	disabled

Recorded inside the VM by the tool, not signed by anyone

nvidia-smi GPU name: NVIDIA H100 80GB HBM3
CC State: ON
Multi-GPU Mode: None
NVIDIA attestation mode: single-gpu
Guest kernel: 6.8.0-110-generic
voltage-verify: 0.2.4bundle written 2026-11-06 14:08:03 UTC

§ 06 / workload manifest

The manifest both proofs carry a hash of

Declared in the manifest; the text fields are user-provided and shown in quotes. Its SHA-512 is the quote's report_data and its SHA-256 the nonce NVIDIA signed: changing one byte breaks both bindings.

Challenge: 3c8e94b8d2be58ce6339f6385740197fe6d62bffe26b73c6c984f3c50e8c8eb9declared in the manifest
Manifest written: 2026-11-06 14:07:59 UTCdeclared in the manifest
Image: none named
SHA-256(manifest): c042736163d27ea8c35243b515a2ec763895056d44b940e7a24ac0f28ace81bethe nonce NVIDIA signed
SHA-512(manifest): cc2d0c7dd317a14fd2743af0d420e43e4c535d7d4c002c99fc958b768b2c7dd21776bc5096107cff7ef2d788c21d7280b8ab043d476d471180a6ee7fb25fb747the report_data Intel's quote carries

§ 07 / embed

Show it where your clients look

The badge links back to this page. If the page is removed, the badge turns grey and reads "not found".

Markdown (README, docs)

[![Attestation verified: Intel TDX + NVIDIA](https://voltagegpu.com/verified/4Fwya1hNkUSyzOxJDC0isw/badge.svg)](https://voltagegpu.com/verified/4Fwya1hNkUSyzOxJDC0isw)

HTML

<a href="https://voltagegpu.com/verified/4Fwya1hNkUSyzOxJDC0isw"><img src="https://voltagegpu.com/verified/4Fwya1hNkUSyzOxJDC0isw/badge.svg" alt="Attestation verified: Intel TDX + NVIDIA" height="22"></a>

Link

https://voltagegpu.com/verified/4Fwya1hNkUSyzOxJDC0isw

Need the same proof for your own workload?

A VoltageGPU Confidential VM hands /dev/tdx_guest to you, with full root over SSH. You generate both proofs yourself, on a challenge you choose; the Confidential VM page lists the GPU types on which NVIDIA attestation has been run.

See Confidential VMs Publish your own verified page