Verifying Intel TDX and NVIDIA GPU attestation from inside a rented VM, and what it can't prove
I run a small confidential GPU cloud. We rent Intel TDX virtual machines with an H100, H200 or RTX PRO 6000 Blackwell passed through, and customers kept asking the only question that matters: how do I know the enclave is real, and that the provider is not in the loop? "Trust our dashboard" is not an answer to that question. So I wrote a verifier the tenant runs themselves, with nothing from us in…
A small confidential GPU cloud rents Intel TDX virtual machines with H100, H200, or RTX PRO 6000 Blackwell GPUs. Customers ask how to verify the enclave's authenticity without the provider being involved. To address this, the author created a verifiable tool, voltage-verify, which runs on the customer's laptop and verifies the enclave inside the VM.
The workflow begins by generating a manifest on the laptop, which is then copied into the VM. The VM runs voltage-verify with the manifest to create a bundle. This bundle can be verified offline using voltage-verify again, with the original challenge from the manifest. The exit code indicates whether the verification was successful.
The manifest contains a random challenge, and the tool requests a quote from the kernel's TDX interface using the SHA-512 of the manifest. The quote is verified up to the Intel SGX Root CA, along with Intel's PCS collateral embedded in the bundle for offline verification. NVIDIA's Remote Attestation Service is queried for GPU tokens, which are checked against the same manifest. Both proofs use the same challenge, preventing replay attacks. Neither the manifest nor the verification process involves the cloud provider's API.
This verification process attests to the hardware and the enclave but does not prove the specific application running inside. To achieve workload identity verification, customers would need to provide a measured image (their own kernel, initramfs, and dm-verity root) with no SSH access. However, this is not supported at the moment due to the NVSwitch fabric not being verifiable from inside the guest.
The author shares a few lessons learned, such as NVSwitch not verifying from inside the guest and intermittent failures with nvattest's local checks due to OCSP problems. These issues can often be traced to outbound network problems in the guest.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
