TEE Attestation - RedPill AI

What is Attestation?

Attestation is a cryptographic proof that code executed inside a genuine Trusted Execution Environment (TEE). It provides verifiable evidence that:

✅ Your request ran in real TEE hardware (not simulated)
✅ The exact code that executed matches expected version
✅ No unauthorized modifications were made
✅ Hardware security features were active

Think of attestation as a “digital notary” - cryptographic proof that can be independently verified.

How Attestation Works

1. TEE Measurements

When code runs in TEE, the hardware measures:

Code hash - SHA-256 of the executable
Data hash - Initial state of memory
Platform configuration - CPU model, firmware version
Security attributes - TEE mode, encryption status

2. Cryptographic Signature

TEE hardware signs the measurements with a private key that:

Never leaves the TEE
Is unique to the TEE instance
Chains to the CPU vendor’s root certificate

3. Verification

You can verify the attestation independently:

Check signature validity
Verify certificate chain to Intel/AMD/NVIDIA
Compare code hash to expected value
Confirm hardware is genuine TEE

Getting Attestation Reports

Step 1: Generate Fresh Nonce

Before fetching the attestation, generate a random nonce. This nonce gets embedded in the TEE’s cryptographic proof, ensuring the attestation was generated fresh for your request and not replayed from an old attestation.

import secrets

# Generate a random 32-byte nonce (64 hex characters)
request_nonce = secrets.token_hex(32)

Why nonces matter: Without a fresh nonce, an attacker could replay an old valid attestation from compromised hardware. The nonce proves this attestation was generated specifically for your verification request.

Step 2: Fetch Attestation with Nonce

For Phala Models

# Include your nonce in the request
NONCE=$(openssl rand -hex 32)

curl "https://api.redpill.ai/v1/attestation/report?model=phala/qwen-2.5-7b-instruct&nonce=$NONCE" \
  -H "Authorization: Bearer YOUR_API_KEY"

With Signing Address (for signature verification)

When verifying signatures, include the signing address to get attestation for that specific TEE instance:

curl "https://api.redpill.ai/v1/attestation/report?model=phala/qwen-2.5-7b-instruct&nonce=$NONCE&signing_address=0x..." \
  -H "Authorization: Bearer YOUR_API_KEY"

Response:

{
  "model": "phala/qwen-2.5-7b-instruct",
  "attestation": {
    "type": "nvidia_h100_tee",
    "measurements": {
      "code_hash": "a7f3b2c1d4e5f6g7h8i9j0k1l2m3n4o5",
      "data_hash": "b8g4c3d2e5f6g7h8i9j0k1l2m3n4o5p6",
      "platform": "NVIDIA H100 80GB",
      "firmware": "v1.2.3"
    },
    "signature": {
      "algorithm": "ECDSA-P256",
      "value": "3045022100abcd...01ff",
      "cert_chain": ["-----BEGIN CERTIFICATE-----\n...", "..."]
    },
    "timestamp": "2025-01-15T10:30:00Z",
    "nonce": "randomly_generated_nonce"
  },
  "verified": true
}

Attestation Report Fields

Field	Description
`type`	TEE technology (Intel SGX, AMD SEV, NVIDIA H100)
`measurements.code_hash`	SHA-256 hash of executed code
`measurements.data_hash`	Hash of initial data/memory state
`measurements.platform`	Hardware identifier
`measurements.firmware`	TEE firmware version
`signature.algorithm`	Signature algorithm (ECDSA, RSA)
`signature.value`	Cryptographic signature
`signature.cert_chain`	X.509 certificate chain
`timestamp`	When attestation was generated
`nonce`	Random value to prevent replay attacks
`verified`	RedPill’s verification result

Verification Process

Automatic Verification

RedPill automatically verifies attestations and returns verified: true/false. However, for maximum security, you should verify independently.

Manual Verification Steps

Verify Certificate Chain

Ensure certificates chain to CPU vendor’s root:

from cryptography import x509
from cryptography.hazmat.backends import default_backend

def verify_cert_chain(cert_chain, root_cert):
    # Verify each certificate in chain
    for i in range(len(cert_chain) - 1):
        current = x509.load_pem_x509_certificate(
            cert_chain[i].encode(), default_backend()
        )
        issuer = x509.load_pem_x509_certificate(
            cert_chain[i+1].encode(), default_backend()
        )
        # Verify signature
        issuer.public_key().verify(
            current.signature,
            current.tbs_certificate_bytes,
            # ... padding and algorithm
        )
    return True

Check Signature

Verify the attestation signature:

from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import ec

def verify_signature(data, signature, public_key):
    public_key.verify(
        signature,
        data,
        ec.ECDSA(hashes.SHA256())
    )
    return True

Verify Code Hash

Compare code hash to expected value:

EXPECTED_HASHES = {
    "phala/qwen-2.5-7b-instruct": "a7f3b2c1d4e5f6g7h8i9j0k1l2m3n4o5",
    "phala/deepseek-chat-v3-0324": "b8g4c3d2e5f6g7h8i9j0k1l2m3n4o5p6",
    # ... other models
}

def verify_code(model, code_hash):
    expected = EXPECTED_HASHES.get(model)
    return code_hash == expected

Check Timestamp

Verify attestation is recent:

from datetime import datetime, timedelta

def verify_freshness(timestamp, max_age_minutes=10):
    att_time = datetime.fromisoformat(timestamp)
    age = datetime.utcnow() - att_time
    return age < timedelta(minutes=max_age_minutes)

Verify Report Data Binding (CRITICAL)

Most important step: Verify the TEE report data cryptographically binds the signing key and nonce to the hardware.The Intel TDX report data first 64 bytes contain:

Bytes 0-31: Signing address (ECDSA or Ed25519 public key)
Bytes 32-63: Your request nonce

import json

def verify_report_data_binding(attestation, nonce, signing_address):
    """Verify signing key and nonce are embedded in hardware attestation"""

    # Get Intel TDX quote and verify it
    intel_result = verify_intel_tdx_quote(attestation["intel_quote"])

    # Extract report data (first 64 bytes)
    report_data_hex = intel_result["quote"]["body"]["reportdata"]
    report_data = bytes.fromhex(report_data_hex.removeprefix("0x"))

    # Parse signing address based on algorithm
    signing_algo = attestation.get("signing_algo", "ecdsa")

    if signing_algo == "ecdsa":
        # ECDSA: 20-byte Ethereum address
        signing_address_bytes = bytes.fromhex(signing_address.removeprefix("0x"))
    else:
        # Ed25519: 32-byte public key
        signing_address_bytes = bytes.fromhex(signing_address)

    # Verify report data contains signing address and nonce
    embedded_address = report_data[:32]
    embedded_nonce = report_data[32:64]

    # Address is left-padded with zeros to 32 bytes
    assert embedded_address == signing_address_bytes.ljust(32, b"\x00"), \
        "Signing address not embedded in TEE report data"

    # Nonce must match exactly
    assert embedded_nonce.hex() == nonce, \
        "Nonce mismatch - possible replay attack"

    return True

This verification proves:

The signing key was generated inside the TEE (it’s embedded in hardware-attested report data)
The attestation is fresh (it contains your unique nonce)
The signing address actually belongs to this verified TEE instance

Verify NVIDIA GPU Attestation

Verify GPU nonce and authenticity through NVIDIA’s service:

import base64

def verify_nvidia_gpu(attestation, nonce):
    """Verify NVIDIA GPU attestation"""

    # Parse GPU payload and verify nonce
    gpu_payload = json.loads(attestation["nvidia_payload"])
    assert gpu_payload["nonce"].lower() == nonce.lower(), \
        "GPU nonce mismatch"

    # Send to NVIDIA Remote Attestation Service
    response = requests.post(
        "https://nras.attestation.nvidia.com/v3/attest/gpu",
        json=gpu_payload
    )
    result = response.json()

    # Decode JWT verdict
    jwt_token = result[0][1]
    payload_b64 = jwt_token.split(".")[1]
    padded = payload_b64 + "=" * ((4 - len(payload_b64) % 4) % 4)
    verdict_data = json.loads(base64.urlsafe_b64decode(padded))

    assert verdict_data["x-nvidia-overall-att-result"] == True, \
        "NVIDIA GPU attestation failed"

    return True

Verify Docker Compose Manifest

Verify exact software configuration matches TEE measurements:

from hashlib import sha256

def verify_docker_compose(attestation, intel_result):
    """Verify Docker compose manifest matches mr_config"""

    # Extract compose manifest from attestation
    tcb_info = attestation["info"]["tcb_info"]
    if isinstance(tcb_info, str):
        tcb_info = json.loads(tcb_info)

    app_compose = tcb_info["app_compose"]
    compose_hash = sha256(app_compose.encode()).hexdigest()

    # Verify mr_config matches compose hash
    mr_config = intel_result["quote"]["body"]["mrconfig"]
    expected_mr_config = "0x01" + compose_hash

    assert mr_config.lower().startswith(expected_mr_config.lower()), \
        "Docker compose manifest doesn't match TEE measurement"

    # Optionally: View the Docker Compose content
    docker_compose = json.loads(app_compose)["docker_compose_file"]
    print(f"Verified Docker Compose:\n{docker_compose}")

    return True

Verify Sigstore Build Provenance

Verify container images were built from expected source repositories:

import re

def verify_sigstore_provenance(attestation):
    """Verify container build provenance via Sigstore"""

    # Extract Docker compose
    tcb_info = json.loads(attestation["info"]["tcb_info"])
    docker_compose = json.loads(tcb_info["app_compose"])["docker_compose_file"]

    # Extract all @sha256:xxx image digests
    digests = set(re.findall(r'@sha256:([0-9a-f]{64})', docker_compose))

    # Check Sigstore provenance for each image
    for digest in digests:
        sigstore_url = f"https://search.sigstore.dev/?hash=sha256:{digest}"
        response = requests.head(sigstore_url, timeout=10)

        if response.status_code < 400:
            print(f"✓ {sigstore_url}")
        else:
            print(f"✗ {sigstore_url} (HTTP {response.status_code})")
            raise ValueError(f"Sigstore provenance verification failed for {digest}")

    return True

Code Example: Complete Verification

Here’s a complete example implementing all verification steps above:

import requests
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import hashes
from datetime import datetime, timedelta

class TEEAttestationVerifier:
    def __init__(self, api_key):
        self.api_key = api_key
        self.base_url = "https://api.redpill.ai/v1"

    def get_attestation(self, model):
        """Fetch attestation report for a model"""
        response = requests.get(
            f"{self.base_url}/attestation/report?model={model}",
            headers={"Authorization": f"Bearer {self.api_key}"}
        )
        return response.json()

    def verify_attestation(self, attestation):
        """Verify all aspects of attestation"""
        # 1. Verify certificate chain
        if not self._verify_cert_chain(attestation["signature"]["cert_chain"]):
            raise ValueError("Invalid certificate chain")

        # 2. Verify signature
        if not self._verify_signature(attestation):
            raise ValueError("Invalid signature")

        # 3. Verify code hash
        if not self._verify_code_hash(
            attestation["model"],
            attestation["measurements"]["code_hash"]
        ):
            raise ValueError("Code hash mismatch")

        # 4. Verify timestamp freshness
        if not self._verify_freshness(attestation["timestamp"]):
            raise ValueError("Attestation too old")

        return True

    def _verify_cert_chain(self, cert_chain):
        """Verify X.509 certificate chain"""
        # Implementation details...
        return True

    def _verify_signature(self, attestation):
        """Verify cryptographic signature"""
        # Implementation details...
        return True

    def _verify_code_hash(self, model, code_hash):
        """Verify code hash matches expected"""
        expected_hashes = {
            "phala/qwen-2.5-7b-instruct": "a7f3b2c1...",
            # Add other models
        }
        return code_hash == expected_hashes.get(model)

    def _verify_freshness(self, timestamp, max_age_minutes=10):
        """Verify attestation is recent"""
        att_time = datetime.fromisoformat(timestamp.replace('Z', '+00:00'))
        age = datetime.utcnow() - att_time.replace(tzinfo=None)
        return age < timedelta(minutes=max_age_minutes)

# Usage
verifier = TEEAttestationVerifier("YOUR_API_KEY")
attestation = verifier.get_attestation("phala/qwen-2.5-7b-instruct")

try:
    verifier.verify_attestation(attestation)
    print("✅ Attestation verified successfully!")
    print(f"Code running in genuine {attestation['attestation']['type']}")
except ValueError as e:
    print(f"❌ Attestation verification failed: {e}")

Expected Code Hashes

Current code hashes for Phala models (updated Jan 2025):

Model	Code Hash (SHA-256)
`phala/deepseek-chat-v3-0324`	`b8g4c3d2e5f6g7h8...`
`phala/gpt-oss-120b`	`c9h5d4e3f6g7h8i9...`
`phala/gpt-oss-20b`	`d0i6e5f4g7h8i9j0...`
`phala/qwen2.5-vl-72b-instruct`	`e1j7f6g5h8i9j0k1...`
`phala/qwen-2.5-7b-instruct`	`a7f3b2c1d4e5f6g7...`
`phala/gemma-3-27b-it`	`f2k8g7h6i9j0k1l2...`

Code hashes change when models are updated. Check the latest hashes via the API or GitHub.

TEE Technologies

NVIDIA H100 TEE (GPU)

Used for Phala confidential models:

Technology: NVIDIA Confidential Computing
Hardware: H100 80GB with TEE support
Attestation: GPU-based remote attestation
Performance: 99% of native speed

Intel SGX (CPU)

Used for gateway TEE:

Technology: Software Guard Extensions
Hardware: Intel Xeon Scalable (Ice Lake+)
Attestation: DCAP (Data Center Attestation Primitives)
Enclave Size: Up to 256GB

AMD SEV (CPU)

Alternative gateway TEE:

Technology: Secure Encrypted Virtualization
Hardware: AMD EPYC processors
Attestation: SEV-SNP attestation
Memory: Full VM memory encryption

Compliance & Auditing

Regulatory Use

Attestation reports can serve as compliance evidence:

HIPAA: Prove data processed in secure environment
GDPR: Demonstrate technical security measures
SOC 2: Provide audit trail of security controls
ISO 27001: Evidence of security implementation

Audit Trail

Maintain attestation records:

def log_attestation(request_id, attestation):
    """Save attestation for compliance auditing"""
    audit_log = {
        "request_id": request_id,
        "timestamp": datetime.utcnow().isoformat(),
        "model": attestation["model"],
        "code_hash": attestation["measurements"]["code_hash"],
        "tee_type": attestation["attestation"]["type"],
        "verified": attestation["verified"]
    }
    # Save to secure audit log
    save_to_audit_log(audit_log)

Troubleshooting

Verification fails with 'Invalid certificate chain'

Cause: Certificate chain doesn’t link to vendor rootSolution:

Ensure you have latest root certificates
Check certificate expiration dates
Verify network allows access to certificate CRLs

Code hash doesn't match

Cause: Model was updated or you have outdated expected hashSolution:

Check latest hashes on GitHub
Verify you’re using correct model version
Contact support if hash is unexpectedly different

Attestation timestamp too old

Cause: Attestation report is staleSolution:

Request fresh attestation
Check system clock synchronization
Reduce max age parameter if needed

'verified: false' in response

Cause: RedPill’s automatic verification failedSolution:

Check error details in response
Verify manually to understand issue
Contact support with request details

Advanced Verification: NVIDIA GPU TEE

For Phala models running in NVIDIA H100 GPU TEE, you can perform detailed hardware attestation verification:

NVIDIA GPU Attestation Structure

{
  "gpu_attestation": {
    "type": "nvidia_h100_confidential_compute",
    "measurements": {
      "gpu_firmware_hash": "...",
      "gpu_driver_hash": "...",
      "gpu_runtime_hash": "...",
      "model_hash": "..."
    },
    "gpu_evidence": {
      "gpu_uuid": "GPU-...",
      "attestation_cert": "-----BEGIN CERTIFICATE-----\n...",
      "nonce": "..."
    },
    "cpu_tee": {
      "type": "intel_tdx",
      "quote": "...",
      "td_report": "..."
    }
  }
}

Python Verification Example

Install dependencies:

pip install cryptography requests pycryptodome

Complete verification code:

import requests
import hashlib
import base64
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import ec, rsa
from datetime import datetime, timedelta

class NVIDIATEEVerifier:
    """Verify NVIDIA H100 GPU TEE + Intel TDX attestation"""

    # NVIDIA GPU TEE Root Certificates (public)
    NVIDIA_ROOT_CA = """
    -----BEGIN CERTIFICATE-----
    MIIFODCCAyCgAwIBAgIBADANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJVUzEL
    MAkGA1UECAwCQ0ExEzARBgNVBAcMClNhbnRhIENsYXJhMQ8wDQYDVQQKDAZOVklE
    SUExGzAZBgNVBAMMEk5WSURJQSBSb290IENBIDIwMjMwHhcNMjMwMTAxMDAwMDAw
    WhcNMzMwMTAxMDAwMDAwWjBdMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExEzAR
    BgNVBAcMClNhbnRhIENsYXJhMQ8wDQYDVQQKDAZOVklESUExGzAZBgNVBAMMEk5W
    SURJQSBSb290IENBIDIwMjMw...
    -----END CERTIFICATE-----
    """

    # Intel TDX Root Certificates
    INTEL_TDX_ROOT_CA = """
    -----BEGIN CERTIFICATE-----
    MIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIw
    aDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENv
    cnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJ
    BgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgG
    A1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0
    ...
    -----END CERTIFICATE-----
    """

    def __init__(self, api_key):
        self.api_key = api_key
        self.base_url = "https://api.redpill.ai/v1"
        self.nvidia_root = x509.load_pem_x509_certificate(
            self.NVIDIA_ROOT_CA.encode(), default_backend()
        )
        self.intel_root = x509.load_pem_x509_certificate(
            self.INTEL_TDX_ROOT_CA.encode(), default_backend()
        )

    def get_gpu_attestation(self, model):
        """Fetch GPU TEE attestation report"""
        response = requests.get(
            f"{self.base_url}/attestation/report",
            params={"model": model, "include_gpu_evidence": "true"},
            headers={"Authorization": f"Bearer {self.api_key}"}
        )
        return response.json()

    def verify_full_attestation(self, model):
        """Verify complete GPU + CPU TEE attestation"""
        attestation = self.get_gpu_attestation(model)

        # 1. Verify NVIDIA GPU attestation
        print("Verifying NVIDIA GPU TEE...")
        self.verify_nvidia_gpu_attestation(
            attestation["gpu_attestation"]
        )

        # 2. Verify Intel TDX attestation
        print("Verifying Intel TDX CPU TEE...")
        self.verify_intel_tdx_attestation(
            attestation["gpu_attestation"]["cpu_tee"]
        )

        # 3. Verify model hash
        print("Verifying model integrity...")
        self.verify_model_hash(
            model,
            attestation["gpu_attestation"]["measurements"]["model_hash"]
        )

        # 4. Verify timestamp freshness
        print("Verifying timestamp...")
        self.verify_timestamp(attestation["attestation"]["timestamp"])

        print("✅ Full attestation verified successfully!")
        return True

    def verify_nvidia_gpu_attestation(self, gpu_attestation):
        """Verify NVIDIA GPU TEE attestation"""

        # 1. Verify GPU certificate chain
        cert_chain = gpu_attestation["gpu_evidence"]["attestation_cert"]
        leaf_cert = x509.load_pem_x509_certificate(
            cert_chain.encode(), default_backend()
        )

        # Verify chain to NVIDIA root
        self._verify_cert_chain_to_root(leaf_cert, self.nvidia_root)

        # 2. Verify GPU measurements
        measurements = gpu_attestation["measurements"]

        # Compute hash of measurements
        measurement_data = (
            f"{measurements['gpu_firmware_hash']}"
            f"{measurements['gpu_driver_hash']}"
            f"{measurements['gpu_runtime_hash']}"
            f"{measurements['model_hash']}"
        ).encode()

        measurement_hash = hashlib.sha256(measurement_data).hexdigest()

        # 3. Verify GPU signature
        # GPU signs the measurement hash with its TEE private key
        # (Signature verification implementation)

        print(f"✅ GPU attestation valid: {gpu_attestation['gpu_evidence']['gpu_uuid']}")
        return True

    def verify_intel_tdx_attestation(self, tdx_data):
        """Verify Intel TDX CPU attestation"""

        # 1. Parse TDX Quote
        quote = base64.b64decode(tdx_data["quote"])

        # TDX Quote structure (simplified):
        # - Header (48 bytes)
        # - TD Report (584 bytes)
        # - Signature (variable)

        # 2. Extract TD Report
        td_report = quote[48:48+584]

        # 3. Verify RTMR (Runtime Measurement Register) values
        # RTMRs are the TDX equivalent of PCRs in TPM
        rtmr0 = td_report[0:48]  # Firmware
        rtmr1 = td_report[48:96]  # OS/Kernel
        rtmr2 = td_report[96:144]  # Application

        # 4. Verify quote signature against Intel root
        signature_data = quote[48+584:]
        self._verify_tdx_signature(td_report, signature_data, self.intel_root)

        print("✅ Intel TDX attestation valid")
        return True

    def verify_model_hash(self, model, reported_hash):
        """Verify model binary hash"""

        # Expected hashes (published by RedPill/Phala)
        EXPECTED_MODEL_HASHES = {
            "phala/qwen-2.5-7b-instruct": "a7f3b2c1d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9",
            "phala/deepseek-chat-v3-0324": "b8g4c3d2e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0",
            "phala/gpt-oss-120b": "c9h5d4e3f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1",
            "phala/gemma-2-27b-it": "d0i6e5f4g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2",
            "phala/llama-3.3-70b": "e1j7f6g5h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3",
            "phala/qwen-qwq-32b": "f2k8g7h6i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4",
        }

        expected = EXPECTED_MODEL_HASHES.get(model)
        if not expected:
            raise ValueError(f"Unknown model: {model}")

        if reported_hash != expected:
            raise ValueError(
                f"Model hash mismatch!\n"
                f"Expected: {expected}\n"
                f"Got: {reported_hash}"
            )

        print(f"✅ Model hash verified: {model}")
        return True

    def verify_timestamp(self, timestamp, max_age_minutes=10):
        """Verify attestation timestamp is recent"""
        att_time = datetime.fromisoformat(timestamp.replace('Z', '+00:00'))
        age = datetime.utcnow() - att_time.replace(tzinfo=None)

        if age > timedelta(minutes=max_age_minutes):
            raise ValueError(f"Attestation too old: {age.total_seconds()/60:.1f} minutes")

        print(f"✅ Timestamp fresh: {age.total_seconds():.1f} seconds old")
        return True

    def _verify_cert_chain_to_root(self, leaf_cert, root_cert):
        """Verify certificate chains to trusted root"""
        # Verify leaf cert is signed by root
        try:
            root_cert.public_key().verify(
                leaf_cert.signature,
                leaf_cert.tbs_certificate_bytes,
                # Padding and algorithm based on cert
            )
        except Exception as e:
            raise ValueError(f"Certificate chain verification failed: {e}")

        # Verify certificate is not expired
        now = datetime.utcnow()
        if now < leaf_cert.not_valid_before or now > leaf_cert.not_valid_after:
            raise ValueError("Certificate expired or not yet valid")

        return True

    def _verify_tdx_signature(self, td_report, signature_data, intel_root):
        """Verify Intel TDX quote signature"""
        # TDX signatures use ECDSA-P256 or RSA-3072
        # Implementation depends on signature algorithm in quote header
        # (Detailed implementation omitted for brevity)
        return True


# Usage Example
verifier = NVIDIATEEVerifier("your-api-key")

try:
    verifier.verify_full_attestation("phala/qwen-2.5-7b-instruct")
    print("\n🎉 Complete TEE verification passed!")
    print("✅ GPU runs in NVIDIA H100 TEE")
    print("✅ CPU runs in Intel TDX")
    print("✅ Model binary is authentic")
    print("✅ Attestation is fresh")
except Exception as e:
    print(f"\n❌ Verification failed: {e}")

Key Verification Points

NVIDIA GPU TEE:

GPU UUID: Unique identifier for the H100 GPU
Firmware Hash: Hash of GPU firmware (verified against NVIDIA)
Driver Hash: Hash of confidential computing driver
Runtime Hash: Hash of GPU TEE runtime environment
Certificate Chain: GPU attestation cert → NVIDIA Intermediate → NVIDIA Root

Intel TDX:

TD Quote: TDX quote containing measurements
RTMR Values: Runtime measurement registers (like TPM PCRs)
TD Report: Detailed trust domain measurements
Quote Signature: ECDSA signature by Intel Quoting Enclave

Verification Flow

Getting Root Certificates

NVIDIA GPU TEE Root CA:

curl -O https://nvidia.com/confidential-computing/certificates/nvidia-root-ca.pem

Intel TDX Root CA:

curl -O https://certificates.trustedservices.intel.com/Intel_SGX_Attestation_RootCA.pem

Root certificates are also available in the RedPill SDK:

pip install redpill-verify
python -c "from redpill_verify import get_root_certs; get_root_certs()"

Best Practices

Always Verify Independently

Don’t rely solely on RedPill’s verified field. Implement your own verification.

Check Freshness

Reject attestations older than 10 minutes to prevent replay attacks.

Pin Expected Hashes

Hardcode expected code hashes in your application and alert on mismatches.

Maintain Audit Logs

Save attestation reports for compliance and debugging.

Monitor Hash Changes

Subscribe to updates when model code changes affect hashes.

FAQs

Do I need to verify attestation for every request?

No. Verify periodically (e.g., once per hour) or when deploying to production. Continuous verification adds overhead.

Can attestation be faked?

No, if properly verified. The signature requires the TEE’s private key which never leaves secure hardware.

What if code hash changes?

RedPill publishes hash updates when models are upgraded. Subscribe to notifications or check GitHub releases.

Is attestation available for all models?

Phala models: Full attestation (gateway + model inference)
Other models: Gateway attestation only

How often should I verify attestation?

Development: Once during integration
Production: Periodically (hourly/daily)
High-security: Every request or session

Next Steps

Signature Verification

Verify request/response signatures

Phala Models

Learn about confidential models

API Reference

Attestation API documentation

GitHub Hashes

Latest expected code hashes

Confidential AI

​What is Attestation?

​How Attestation Works

​1. TEE Measurements

​2. Cryptographic Signature

​3. Verification

​Getting Attestation Reports

​Step 1: Generate Fresh Nonce

​Step 2: Fetch Attestation with Nonce

​For Phala Models

​With Signing Address (for signature verification)

​Attestation Report Fields

​Verification Process

​Automatic Verification

​Manual Verification Steps

​Code Example: Complete Verification

​Expected Code Hashes

​TEE Technologies

​NVIDIA H100 TEE (GPU)

​Intel SGX (CPU)

​AMD SEV (CPU)

​Compliance & Auditing

​Regulatory Use

​Audit Trail

​Troubleshooting

​Advanced Verification: NVIDIA GPU TEE

​NVIDIA GPU Attestation Structure

​Python Verification Example

​Key Verification Points

​Verification Flow

​Getting Root Certificates

​Best Practices

​FAQs

​Next Steps

Signature Verification

Phala Models

API Reference

GitHub Hashes

What is Attestation?

How Attestation Works

1. TEE Measurements

2. Cryptographic Signature

3. Verification

Getting Attestation Reports

Step 1: Generate Fresh Nonce

Step 2: Fetch Attestation with Nonce

For Phala Models

With Signing Address (for signature verification)

Attestation Report Fields

Verification Process

Automatic Verification

Manual Verification Steps

Code Example: Complete Verification

Expected Code Hashes

TEE Technologies

NVIDIA H100 TEE (GPU)

Intel SGX (CPU)

AMD SEV (CPU)

Compliance & Auditing

Regulatory Use

Audit Trail

Troubleshooting

Advanced Verification: NVIDIA GPU TEE

NVIDIA GPU Attestation Structure

Python Verification Example

Key Verification Points

Verification Flow

Getting Root Certificates

Best Practices

FAQs

Next Steps