lux/cc

mirror of https://github.com/luxfi/cc.git synced 2026-09-24 00:24:54 +00:00

T

zeekay da19c97e0e feat(attest): KindTDX is production-real — full Intel DCAP v4 quote verification

TDX was a fail-loud stub (Verify returned ErrNotImplemented, parsing nothing).
It now performs the complete Intel TDX DCAP attestation flow via the canonical
Google verifier github.com/google/go-tdx-guest (v0.3.1, sibling of the
go-sev-guest used by KindSEVSNP), matching the SEV path's rigor:

  - Parse the DCAP v4 quote (QuoteV4 only) via go-tdx-guest/abi.
  - Verify the PCK certificate chain embedded in the quote's signed
    certification data up to the Intel SGX Root CA pinned inside go-tdx-guest
    (verify/trusted_root.pem) — the trust anchor is never taken from the quote.
  - Verify the Quoting Enclave (QE) report signature and the attestation-key
    binding (QE report data == SHA-256(att key || QE auth data)).
  - Verify the TD report (TDQuoteBody) ECDSA-P256 signature.
  - Fetch Intel PCS collateral (TCB Info + QE Identity + PCK/Root CRLs) and
    enforce TCB status (UpToDate) and revocation. GetCollateral and
    CheckRevocations are ON; DefaultOptions leaves them off, so we set them.
  - Fold MRTD + the four RTMRs into a 48-byte SHA-384 TD measurement root
    (Measurement); raw registers + MRSEAM/TD_ATTRIBUTES/XFAM/etc. in Extra.
  - Enforce caller policy (expected measurement / report-data nonce binding)
    in constant time, and bind CompositeHash to the canonical TD fields.

(nil, err) always means refuse — no partial report, no best-effort fallback.
go-tdx-guest error strings are classified onto the package refusal taxonomy
(ErrInvalidEvidence / ErrSignatureInvalid / ErrChainInvalid / ErrPolicy).

Tests (attest/tdx_test.go) run offline against a REAL Intel Sapphire Rapids
TDX quote + Intel collateral committed verbatim to testdata/ (from the
go-tdx-guest corpus; the go-tdx-guest `testing` getter is linux-gated, so a
small replay getter is used here):
  - real SPR quote passes the full DCAP cryptographic chain;
  - full production path refuses the fixture on TCB status (upstream
    deliberately bumped the sample TCB SVN above the quote) -> ErrPolicy;
  - tamper rejection: flipped MRTD breaks the TD report signature, flipped
    ECDSA sig rejected, bad version / truncation / garbage -> ErrInvalidEvidence;
  - measurement fold + composite hash determinism + policy binding;
  - no-fallback when Intel PCS is unreachable; stale-clock refusal; Dispatch
    routing; context cancellation.

verifier_test.go: retired TestStubsReturnNotImplemented /
TestDispatch_StubKindsReturnNotImplemented (TDX was the last stub kind they
asserted) now that TDX is real — mirrors the earlier NVTrust promotion which
already edited this file. go.mod/go.sum: add go-tdx-guest v0.3.1 (latest, < v1).

GOWORK=off go build/vet/test/-race ./... all green.

2026-06-27 13:49:26 -07:00

attest

feat(attest): KindTDX is production-real — full Intel DCAP v4 quote verification

2026-06-27 13:49:26 -07:00

.gitignore

feat(attest): genesis leaf module — one attestation verifier, orthogonal Kinds

2026-06-27 12:11:46 -07:00

go.mod

feat(attest): KindTDX is production-real — full Intel DCAP v4 quote verification

2026-06-27 13:49:26 -07:00

go.sum

feat(attest): KindTDX is production-real — full Intel DCAP v4 quote verification

2026-06-27 13:49:26 -07:00

README.md

feat(attest): genesis leaf module — one attestation verifier, orthogonal Kinds

2026-06-27 12:11:46 -07:00

README.md

luxfi/cc — Confidential Compute attestation

github.com/luxfi/cc is the single, vendor-neutral attestation verifier for the Lux confidential-compute control plane. It is an orthogonal leaf: the MPC custody system (luxfi/mpc), the TEE custody extension (luxfi/tee), and the confidential-AI / proof-of-AI system (luxfi/ai) all depend on it, and it depends on none of them. There is exactly one attestation verifier; hardware platforms are orthogonal Kinds behind one Verify interface.

Packages

Import	Purpose
`github.com/luxfi/cc/attest`	The `Verifier` interface, `VerifiedReport`, `Option`, and `Dispatch(kind, evidence, opts...)`. One entry point per hardware `Kind`.
`github.com/luxfi/cc/attest/nvidia`	NVIDIA GPU primitives: GPU evidence parser, signed-RIM verifier + measurement matcher, and the NRAS remote-attestation JWS client. Backend for `KindNVTrust`.

Kinds (orthogonal hardware platforms)

KindSEVSNP — AMD SEV-SNP CPU. PRODUCTION. Live VCEK fetch from the AMD KDS, full ARK→ASK→VCEK chain + report-signature verification (google/go-sev-guest).
KindTDX — Intel TDX CPU. Stub (ErrNotImplemented, fail-loud). Tracked for go-tdx-guest + Intel PCS.
KindNVTrust — NVIDIA GPU confidential compute. PRODUCTION local-RIM mode (cloud-free): verifies the NVIDIA-signed Reference Integrity Manifest against an operator-pinned key, then matches every reported GPU measurement to the signed golden value. No NVIDIA cloud dependency. The remote NVIDIA Remote Attestation Service (NRAS) JWS path is the lower-level nvidia.NRASClient primitive for deployments that accept a cloud anchor.

Invariants

No insecure mode. A verify with no trust anchor is refused, never best-effort. KindNVTrust refuses an empty RIM or empty trust-root set.
One VerifiedReport type shared across all consumers — required so the kms.CompositeAttestation release-gate interface has a single, unambiguous signature across luxfi/mpc, luxfi/tee, and luxfi/ai.
(nil, err) means refuse. No partial reports on error.
Tests never hit the network. AMD KDS responses are replayed from attest/testdata; NVIDIA RIM fixtures are signed in-test.

Build

export SDKROOT="$(xcrun --show-sdk-path)"   # macOS
GOWORK=off go build ./...
GOWORK=off go test ./...