lux/cc

mirror of https://github.com/luxfi/cc.git synced 2026-09-24 00:24:54 +00:00

T

zeekay c84126eaa1 feat(attest/nvtrust): real NVIDIA GPU CC verification — SPDM report sig + device-chain + RIM, ModeLocal/ModeNRAS

The prior KindNVTrust local path was cryptographically hollow: it matched
PLAINTEXT JSON measurements against the (public) RIM and never parsed or
verified the GPU-signed SPDM report or the device certificate chain — a
host could echo golden values and pass. This makes it production-real.

ModeLocal (cloud-free, full hardware verify), in order, refusing on any
failure:
  1. chain the GPU device leaf cert to an operator-pinned NVIDIA device-
     identity root (no insecure mode; empty root => refuse);
  2. verify the SPDM MEASUREMENTS (0x60) response signature over the
     DSP0274 transcript (request || response[:-sig]) with the leaf key,
     SPDM 1.1 and 1.2, ECDSA P-384/P-256 + RSA-PSS, with a strict
     algo<->key-type binding (substitution defense);
  3. extract measurements from the SIGNED record and match them BY INDEX
     to the NVIDIA-signed RIM (completeness enforced — closes the drop-a-
     bad-measurement attack);
  4. bind the SIGNED requester nonce to the caller's freshness challenge.

ModeNRAS (remote): verify an NVIDIA NRAS EAT/JWT — JWS signature against
pinned signer keys (or x5c chain to a pinned NRAS root), exp/nbf freshness,
eat_nonce binding, positive overall-result. No network in Verify (the POST
stays in NRASClient).

GPU measurement -> VerifiedReport.Measurement (RIM root / EAT root); trust-
score/tier stays caller policy on top. ChipID is the trusted leaf serial,
not the untrusted envelope UUID. Trust anchors are operator-pinned via
NewNVTrust options, never from evidence; the zero value (Dispatch) is fail-
closed. No new dependencies (stdlib crypto only).

New: attest/nvidia/{spdm,devicechain,eat}.go. Extended: gpu_report.go
(spdm_request/response/asym_algo), rim.go (index-keyed MatchSPDM). 30 new
tests: self-consistent SPDM+chain+RIM vectors (1.1 and 1.2), NRAS EAT
vectors, and tamper rejection (bad SPDM sig, tampered signed record, wrong
device root, RIM mismatch, RIM sig tamper, nonce mismatch, missing SPDM,
bad/expired/negative EAT). go build + go test ./... green (race-clean).

2026-06-27 13:51:24 -07:00

attest

feat(attest/nvtrust): real NVIDIA GPU CC verification — SPDM report sig + device-chain + RIM, ModeLocal/ModeNRAS

2026-06-27 13:51:24 -07:00

.gitignore

feat(attest): genesis leaf module — one attestation verifier, orthogonal Kinds

2026-06-27 12:11:46 -07:00

go.mod

feat(attest): genesis leaf module — one attestation verifier, orthogonal Kinds

2026-06-27 12:11:46 -07:00

go.sum

feat(attest): genesis leaf module — one attestation verifier, orthogonal Kinds

2026-06-27 12:11:46 -07:00

README.md

feat(attest): genesis leaf module — one attestation verifier, orthogonal Kinds

2026-06-27 12:11:46 -07:00

README.md

luxfi/cc — Confidential Compute attestation

github.com/luxfi/cc is the single, vendor-neutral attestation verifier for the Lux confidential-compute control plane. It is an orthogonal leaf: the MPC custody system (luxfi/mpc), the TEE custody extension (luxfi/tee), and the confidential-AI / proof-of-AI system (luxfi/ai) all depend on it, and it depends on none of them. There is exactly one attestation verifier; hardware platforms are orthogonal Kinds behind one Verify interface.

Packages

Import	Purpose
`github.com/luxfi/cc/attest`	The `Verifier` interface, `VerifiedReport`, `Option`, and `Dispatch(kind, evidence, opts...)`. One entry point per hardware `Kind`.
`github.com/luxfi/cc/attest/nvidia`	NVIDIA GPU primitives: GPU evidence parser, signed-RIM verifier + measurement matcher, and the NRAS remote-attestation JWS client. Backend for `KindNVTrust`.

Kinds (orthogonal hardware platforms)

KindSEVSNP — AMD SEV-SNP CPU. PRODUCTION. Live VCEK fetch from the AMD KDS, full ARK→ASK→VCEK chain + report-signature verification (google/go-sev-guest).
KindTDX — Intel TDX CPU. Stub (ErrNotImplemented, fail-loud). Tracked for go-tdx-guest + Intel PCS.
KindNVTrust — NVIDIA GPU confidential compute. PRODUCTION local-RIM mode (cloud-free): verifies the NVIDIA-signed Reference Integrity Manifest against an operator-pinned key, then matches every reported GPU measurement to the signed golden value. No NVIDIA cloud dependency. The remote NVIDIA Remote Attestation Service (NRAS) JWS path is the lower-level nvidia.NRASClient primitive for deployments that accept a cloud anchor.

Invariants

No insecure mode. A verify with no trust anchor is refused, never best-effort. KindNVTrust refuses an empty RIM or empty trust-root set.
One VerifiedReport type shared across all consumers — required so the kms.CompositeAttestation release-gate interface has a single, unambiguous signature across luxfi/mpc, luxfi/tee, and luxfi/ai.
(nil, err) means refuse. No partial reports on error.
Tests never hit the network. AMD KDS responses are replayed from attest/testdata; NVIDIA RIM fixtures are signed in-test.

Build

export SDKROOT="$(xcrun --show-sdk-path)"   # macOS
GOWORK=off go build ./...
GOWORK=off go test ./...