snp

Documentation

Overview

SNP

Attestation based on TPM and SEV-SNP attestation. The TPM is used to generate runtime measurements and signed by an attestation key that can be verified using the SEV-SNP attestation report.

Issuer

Generates a TPM attestation using an attestation key saved in the TPM. Additionally loads the SEV-SNP attestation report and AMD VCEK certificate chain, and adds them to the attestation document.

Validator

Verifies the attestation key used by first verifying the VCEK certificate chain and the SNP attestation report.

Glossary

This section explains abbreviations used in SNP implementation.

• Attestation Key (AK)

• AMD Root Key (ARK)

• AMD Signing Key (ASK)

• Versioned Chip Endorsement Key (VCEK)

  For more information see SNP WhitePaper

• Host (Hardware?) Compatibility Layer (HCL)

  No public information. Azure compute API has a field `isHostCompatibilityLayerVm`, with only a single sentence of documentation.

Index

• type Issuer
  • func NewIssuer(log attestation.Logger) *Issuer
• type Validator
  • func NewValidator(cfg *config.AzureSEVSNP, log attestation.Logger) *Validator

Types

type Issuer

type Issuer struct {
	variant.AzureSEVSNP
	*vtpm.Issuer
	// contains filtered or unexported fields
}

Issuer for Azure TPM attestation.

func NewIssuer

func NewIssuer(log attestation.Logger) *Issuer

NewIssuer initializes a new Azure Issuer.

type Validator

type Validator struct {
	variant.AzureSEVSNP
	*vtpm.Validator
	// contains filtered or unexported fields
}

Validator for Azure confidential VM attestation.

func NewValidator

func NewValidator(cfg *config.AzureSEVSNP, log attestation.Logger) *Validator

NewValidator initializes a new Azure validator with the provided PCR values.