Checked by VoltageGPU · 28 October 2026

Attestation verifiedIntel TDX + NVIDIA confidential computing

An Intel TDX quote, generated inside an Intel TDX trust domain, and NVIDIA GPU attestation tokens, both carrying a hash of the same workload manifest. VoltageGPU checked the quote's signature chain up to Intel's root and the tokens' signatures up to NVIDIA's attestation service. You can check them again yourself, offline, with the commands below.

Download the bundle Re-verify it yourself

Attested: 2026-10-28 11:14:05 UTC; time signed by NVIDIA
GPU: 1 × GH100; NVIDIA Hopper (GH100), model signed by NVIDIA
CPU trust domain: Intel TDX; quote v4, chained to the Intel SGX Root CA
Intel TCB: UpToDate; per Intel, 28 October 2026

§ 01 / checked by VoltageGPU

What we verified, line by line

Run on 2026-10-28 11:14:32 UTC by voltagegpu-verified/1: the checks of voltage-verify verify --offline, made stricter (debug mode, GPU token binding, NVIDIA keys chained to a pinned NVIDIA certificate, Intel collateral dated against the NVIDIA-signed time). Each line says what passing means and what the code saw.

Bundle

Manifest commitmentsmanifest.commitments
SHA-256 and SHA-512 of the workload manifest are recomputed and match the bundle (bookkeeping; the binding itself is checked below).
SHA-256 and SHA-512 of the canonical manifest equal the commitments recorded in the bundle

Intel TDX

TDX quote structuretdx.structure
The quote is an Intel TDX quote, version 4, TEE type 0x81, with an ECDSA P-256 attestation key and a PCK certificate chain.
TDX quote v4, TEE type 0x81, 4940 bytes
Quote bound to the manifesttdx.report_data
The 64-byte report_data inside the quote is the SHA-512 of the manifest, so the quote was requested with this manifest and its challenge.
quote report_data equals SHA-512 of the manifest
Trust domain not in debug modetdx.debug
The TD attributes signed in the quote say debug is off: the host cannot read the trust domain’s memory through the debug interface.
TDATTRIBUTES.DEBUG is 0
Intel signature chaintdx.signatures
The attestation key signs the quote, the Quoting Enclave vouches for that key, and the platform certificate chains to the Intel SGX Root CA we pin.
attestation key, QE binding, QE report and PCK chain verify up to the pinned Intel SGX Root CA
Intel collateraltdx.collateral
The TCB info and Quoting Enclave identity carried in the bundle are signed by Intel’s SGX TCB Signing certificate, which chains to the same pinned root and is not on Intel’s revocation list.
TCB info and QE identity are signed by Intel's SGX TCB Signing certificate, chained to the pinned Intel SGX Root CA and not revoked; fields read from the signed bytes only
Platform TCB leveltdx.tcb
By Intel’s TCB info and QE identity, both valid at the NVIDIA-signed attestation time, the platform firmware, the TDX module and the Quoting Enclave were at a level Intel rates UpToDate (or SWHardeningNeeded).
platform TCB UpToDate, QE UpToDate, TDX_01 UpToDate, per Intel TCB info issued 2026-10-28
Revocationtdx.revocation
Intel’s revocation lists, signed by their issuers and valid at the attestation time, do not list the platform certificate or its CA.
PCK certificate not revoked (57 entries in Intel's PCK CRL), PCK CA not revoked (0 entries in the root CRL), both CRLs valid at attestation time

NVIDIA GPU

NVIDIA signaturesnvidia.signatures
NVIDIA’s Remote Attestation Service signed the GPU tokens, with keys carried in the bundle whose certificates chain to an NVIDIA Attestation Service intermediate (pinned by us, or served by NVIDIA’s own key endpoint), so the downloaded bundle verifies offline with the same keys.
2 NVIDIA-signed tokens verify (ES384, issuer NRAS) with keys carried in the bundle, certificates chained to the pinned NVIDIA Attestation Service intermediate
GPU attestation bound to the manifestnvidia.nonce
The nonce NVIDIA signed is the SHA-256 of the same manifest, so the GPU attestation was requested with the same manifest and challenge as the TDX quote. The two proofs are tied together only through that manifest hash.
NRAS eat_nonce equals SHA-256 of the manifest, in the verifier token and every GPU token
GPU tokens belong to this attestationnvidia.binding
Every per-GPU token is the exact one NVIDIA’s summary token names by digest: none was swapped in from another session or left out.
each GPU token is the one NVIDIA's verifier token names (SHA-256 digest in submods), 1 GPU(s)
GPU claimsnvidia.policy
NVIDIA reports, for every GPU: measurements match NVIDIA’s reference values, secure boot on, debug disabled, nonce matched, report signature and certificate chain valid.
overall result true; every GPU: measurements success, secure boot on, debug disabled, nonce matched, report signature and certificate chain validated by NVIDIA
Token issued with the bundlenvidia.freshness
NVIDIA issued its token after the creation time declared in the manifest, within 24 hours of it, and not in the future.
NVIDIA token issued 2s after the time declared in the manifest

§ 02 / re-verify it yourself

Do not take our word for it

The trust chain ends at Intel and NVIDIA, not at VoltageGPU. These commands run on your machine.

Get the tool and this exact bundle
voltage-verify is open source (MIT, Python 3.10+). The bundle is the file these checks ran on; compare its SHA-256 with the one printed at the bottom of this page.
Shell
```
pip install "voltage-verify>=0.2.3"
curl -fsSL -o bundle.json https://voltagegpu.com/verified/G4j3YHRBzc16tqt85IAvXg/bundle.json
sha256sum bundle.json
```
Every check, on your machine, from the bundle alone
Re-runs the checks above with the Intel collateral and the NVIDIA keys carried in the bundle, no network needed. voltage-verify takes NVIDIA's public keys from the bundle and checks that each signing key chains to an NVIDIA Attestation Service intermediate pinned in the tool. Without --offline it also fetches Intel's current collateral; NVIDIA's keys still come from the bundle.
Shell
```
voltage-verify verify bundle.json --offline --challenge 45a8c6a338042b0012d5dbd51954555376e6cd71015ddd607fb820bfd7dd2b85 --hwmodel GH100 --gpus 1
```

Intel's verdict today

We rated the platform with Intel's TCB info embedded at attestation time. This asks Intel's servers now: signature chain, current TCB status, Quoting Enclave identity and revocation, with the quote still bound to this manifest through its report_data.

Shell

python3 -c "import json,base64;s=json.load(open('bundle.json'))['tdx']['quote_b64'];open('quote.bin','wb').write(base64.b64decode(s+'='*(-len(s)%4)))"
voltage-verify quote quote.bin --report-data 4b640c4650dd729d197db4c48b666b9c3085c2f0c69b93918ec0f68bd04fc7e18d2206b8b142286030ad788ebc91b749b17421f17a20a0396ac2bb452fbb5a3d

Watch it fail when it should
Nine tampered copies must each be rejected: three manifest changes (image, artifact, another field), a replayed challenge, one byte of the quote, one claim in a GPU token, tokens re-signed with an attacker key, a duplicated key id and a stripped certificate chain in the bundle JWKS.
Shell
```
voltage-verify selftest bundle.json --offline --challenge 45a8c6a338042b0012d5dbd51954555376e6cd71015ddd607fb820bfd7dd2b85
```
That the challenge is yours
Only whoever generated the challenge knows it was fresh. If you asked for this proof, check that the challenge above is the one you issued: a replayed bundle carries someone else's.
That the measurements are the VM image you trust
MRTD and RTMR0 to RTMR3 measure the initial VM state and boot chain. Whether they match a reference image is a policy decision we do not make for you.

§ 03 / limits

What this page does not prove

That the trust domain and the GPU are the same machine. The Intel quote and the NVIDIA tokens are tied to each other only through the manifest hash they both carry.
That the GPU executed the image or model named in the manifest. Both proofs carry a hash of a description of the workload, not of the code that ran; that needs a measured launcher.
Which company operated the machine. The proofs come from Intel and NVIDIA hardware and name no cloud provider.
Who uploaded this page, or who wrote the manifest. Its free-text fields are user-provided; their hash is in both proofs, so a copied bundle still carries its original text and challenge.

§ 04 / Intel TDX

Measurements and platform status

Read from the signed TD report inside the quote.

MRTD: eea8b6a814569a52bd1e12f6b869bb2d9c0c8a7a43e658ffc3b42c199f116157ea7f04d359c7fdfd8ac483152cc13542initial contents of the trust domain (firmware image)
RTMR0: 7a15ca5d3b2b5132347a552586a1c3ee53b6b5acd7c1c0e2e175adc0018058326416389ef31faa3b99669e2fbe36acfetypically firmware configuration
RTMR1: 965b54adf526d37237906189a31d9b058c39fac8909d9689e3340505aac4176deed2c2f3374b226304b23137d4832ae9typically boot loader and kernel
RTMR2: a30945c6f37d06882a5b28be97511caaa3b3f041fa930a9375993116042faea2efe378b3f15bb14259214079ea382f5ctypically kernel command line and initrd
RTMR3: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000free for the workload to extend
MRSEAM: 7bf063280e94fb051f5dd7b1fc59ce9aac42bb961df8d44b709c9b0ff87a7b4df648657ba6d1189589feab1d5a3c9a9dthe Intel TDX module
REPORTDATA: 4b640c4650dd729d197db4c48b666b9c3085c2f0c69b93918ec0f68bd04fc7e18d2206b8b142286030ad788ebc91b749b17421f17a20a0396ac2bb452fbb5a3dSHA-512 of the manifest
TDATTRIBUTES: 0000001000000000debug off
XFAM: e702060000000000
TEE_TCB_SVN: 0b010400000000000000000000000000
FMSPC: b0c06f000000Intel platform family
Quote: v4, TEE type 0x81, 4940 bytes

Platform TCB: UpToDateTCB level of 2025-08-13
Quoting Enclave: UpToDate
TDX module: TDX_01 UpToDate
Intel TCB info: issued 2026-10-28 10:59:06 UTCembedded in the bundle at attestation time, signed by Intel

§ 05 / NVIDIA

GPU attestation claims

Signed by NVIDIA, 2026-10-28 11:14:05 UTC
GPU	Model	Driver	VBIOS	Measurements	Secure boot	Debug
GPU-0	NVIDIA Hopper (GH100)	595.71.05	96.00.CF.00.01	success	on	disabled

Recorded inside the VM by the tool, not signed by anyone

nvidia-smi GPU name: NVIDIA H100 80GB HBM3
CC State: ON
Multi-GPU Mode: None
NVIDIA attestation mode: single-gpu
Guest kernel: 6.8.0-110-generic
voltage-verify: 0.2.3bundle written 2026-10-28 11:14:07 UTC

§ 06 / workload manifest

The manifest both proofs carry a hash of

Declared in the manifest; the text fields are user-provided and shown in quotes. Its SHA-512 is the quote's report_data and its SHA-256 the nonce NVIDIA signed: changing one byte breaks both bindings.

Challenge: 45a8c6a338042b0012d5dbd51954555376e6cd71015ddd607fb820bfd7dd2b85declared in the manifest
Manifest written: 2026-10-28 11:14:03 UTCdeclared in the manifest
Image: none named
SHA-256(manifest): 931334dd9e84418be8c805dda9bdec1f6514d9a8fa794504f6ad787d1dbb02ecthe nonce NVIDIA signed
SHA-512(manifest): 4b640c4650dd729d197db4c48b666b9c3085c2f0c69b93918ec0f68bd04fc7e18d2206b8b142286030ad788ebc91b749b17421f17a20a0396ac2bb452fbb5a3dthe report_data Intel's quote carries

§ 07 / embed

Show it where your clients look

The badge links back to this page. If the page is removed, the badge turns grey and reads "not found".

Markdown (README, docs)

[![Attestation verified: Intel TDX + NVIDIA](https://voltagegpu.com/verified/G4j3YHRBzc16tqt85IAvXg/badge.svg)](https://voltagegpu.com/verified/G4j3YHRBzc16tqt85IAvXg)

HTML

<a href="https://voltagegpu.com/verified/G4j3YHRBzc16tqt85IAvXg"><img src="https://voltagegpu.com/verified/G4j3YHRBzc16tqt85IAvXg/badge.svg" alt="Attestation verified: Intel TDX + NVIDIA" height="22"></a>

Link

https://voltagegpu.com/verified/G4j3YHRBzc16tqt85IAvXg

Need the same proof for your own workload?

A VoltageGPU Confidential VM hands /dev/tdx_guest to you, with full root over SSH. You generate both proofs yourself, on a challenge you choose; the Confidential VM page lists the GPU types on which NVIDIA attestation has been run.

See Confidential VMs Publish your own verified page