Attestation verified page for Intel TDX and NVIDIA GPU attestation
Upload the evidence bundle written by the open-source voltage-verify tool inside a Confidential VM. VoltageGPU checks the Intel TDX quote (structure, report_data equal to the manifest hash, signature chain to the Intel SGX Root CA, TCB level and revocation from Intel collateral valid at attestation time) and the NVIDIA Remote Attestation Service tokens (signatures, nonce equal to the manifest hash, per-GPU measurements, secure boot and debug state). Publishing is optional and creates an unlisted, non-indexed page with a badge and the exact commands to re-verify offline.
- Manifest commitments: SHA-256 and SHA-512 of the workload manifest are recomputed and match the bundle (bookkeeping; the binding itself is checked below).
- TDX quote structure: The quote is an Intel TDX quote, version 4, TEE type 0x81, with an ECDSA P-256 attestation key and a PCK certificate chain.
- Quote bound to the manifest: The 64-byte report_data inside the quote is the SHA-512 of the manifest, so the quote was requested with this manifest and its challenge.
- Trust domain not in debug mode: The TD attributes signed in the quote say debug is off: the host cannot read the trust domain’s memory through the debug interface.
- Intel signature chain: The attestation key signs the quote, the Quoting Enclave vouches for that key, and the platform certificate chains to the Intel SGX Root CA we pin.
- Intel collateral: The TCB info and Quoting Enclave identity carried in the bundle are signed by Intel’s SGX TCB Signing certificate, which chains to the same pinned root and is not on Intel’s revocation list.
- Platform TCB level: By Intel’s TCB info and QE identity, both valid at the NVIDIA-signed attestation time, the platform firmware, the TDX module and the Quoting Enclave were at a level Intel rates UpToDate (or SWHardeningNeeded).
- Revocation: Intel’s revocation lists, signed by their issuers and valid at the attestation time, do not list the platform certificate or its CA.
- NVIDIA signatures: NVIDIA’s Remote Attestation Service signed the GPU tokens, with keys carried in the bundle whose certificates chain to an NVIDIA Attestation Service intermediate (pinned by us, or served by NVIDIA’s own key endpoint), so the downloaded bundle verifies offline with the same keys.
- GPU attestation bound to the manifest: The nonce NVIDIA signed is the SHA-256 of the same manifest, so the GPU attestation was requested with the same manifest and challenge as the TDX quote. The two proofs are tied together only through that manifest hash.
- GPU tokens belong to this attestation: Every per-GPU token is the exact one NVIDIA’s summary token names by digest: none was swapped in from another session or left out.
- GPU claims: NVIDIA reports, for every GPU: measurements match NVIDIA’s reference values, secure boot on, debug disabled, nonce matched, report signature and certificate chain valid.
- Token issued with the bundle: NVIDIA issued its token after the creation time declared in the manifest, within 24 hours of it, and not in the future.
Attestation verified · share the proof
Show your clients the proof,not a promise.
You generated an Intel TDX quote and an NVIDIA GPU attestation inside your Confidential VM with voltage-verify. Upload the bundle: we check both signature chains up to Intel and NVIDIA. If every check passes, you can publish a page and a badge that your clients or auditors can open, and re-verify on their own machine.
§ 01 / how it works
Three steps: the proofs are generated inside your VM, not by us
Our API cannot produce these proofs for you. The TDX quote is produced inside your VM and NVIDIA's attestation service signs the GPU tokens, on a challenge you choose. This page checks what you upload and stores it only if you publish.
§ 02 / what we check
Every line on a verified page is one of these checks
The same checks as voltage-verify verify --offline, plus three stricter ones. A bundle can be published only if all of them pass.
§ 03 / what gets published
Your data, your call
- Nothing is stored when you only check a bundle.
- A published page shows the workload manifest (statement, challenge, image and artifact names and digests), the TDX measurements, the GPU claims, and offers the bundle for download.
- Before storage we keep only the fields voltage-verify writes, drop NVIDIA keys that did not sign, and drop unsigned VM details that look like secrets. A bundle containing a private key is refused outright, and so is a manifest containing anything that looks like a password or token.
- Pages have a random, unlisted address and are never indexed by search engines.
- The downloadable bundle includes hardware identifiers: the GPU UUIDs recorded by nvidia-smi, NVIDIA's device identifier (ueid) in the GPU tokens, and the platform's Intel PCK certificate in the quote. They can link the page to a physical machine.
- One page per attestation: publishing the same bundle again returns the existing page.
- You get a private removal link when you publish; we keep only its hash.
No bundle yet?
A Confidential VM gives you /dev/tdx_guest and full root, so you can run voltage-verify yourself. The tool is open source and works on any Intel TDX guest.