Skip to content

docs(testing): the TDX row covers the quote, not the TDREPORT (#370) #529

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
imran-siddique merged 1 commit into from
Aug 19, 2026
Merged

docs(testing): the TDX row covers the quote, not the TDREPORT (#370) #529

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion docs/testing/hardware-validation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ been verified end to end by `cmcp_verify`, and the run is recorded below.
| Platform | Report parsing | Certificate chain | Report signature | Verified against real hardware evidence |
|---|---|---|---|---|
| AMD SEV-SNP (Azure CVM, vTPM-rooted) | Yes | Yes, to the real AMD ARK-Milan root | Yes | **Yes**, 2026-07-27, both from a stored capture and **live inside a running CVM** |
| Intel TDX (GCP C3, non-paravisor) | Yes | Yes, to the pinned Intel SGX Root CA | Yes | **Yes**, 2026-07-27, capture of 2026-07-21 |
| Intel TDX (GCP C3, non-paravisor) | Yes | Yes, to the pinned Intel SGX Root CA | Yes | **Yes**, 2026-07-27, capture of 2026-07-21. DCAP quote path only; the TDREPORT path is unvalidated, see below |
| TPM 2.0 (Azure vTPM, Trusted Launch) | Yes | Not yet (`ek_cert_chain` stays unverified, see #431) | Yes | **Yes**, 2026-07-31. AK-signed quote verified end to end, tampered copies rejected; certificate chain still open |
| NVIDIA GPU CC (H100/H200) | Not implemented | | | No |

Expand Down Expand Up @@ -113,6 +113,18 @@ The capture directory holds `tdx_quote.bin`. Optional: `collateral/intel_root_ca
to override the pinned root, and `report_data.hex` to assert the report_data
binding. The quote is not committed: the PCK certificate identifies the CPU.

What this run does not cover: the TDREPORT path. `verify_tdx_measurement()`
parses the 1024-byte TDREPORT_STRUCT returned by the `TDX_CMD_GET_REPORT0`
ioctl, which is a different artifact from the DCAP quote captured here, and no
real TDREPORT has been checked against it. #371 found both of its field offsets
wrong -- `MRTD` read from inside `REPORTMACSTRUCT.report_data` and `REPORTDATA`
read from the leading RESERVED block -- and #527 corrected them against the
published Intel TDX Module ABI. The correction is asserted against the ABI and
against a property no hardware is needed to state (a measurement must not move
when only the nonce moves), which is not the same as a capture. The row above
covers quote verification; read it as covering measurement provenance only once
a TDREPORT capture appears here.

This run is what found the parser defect fixed alongside this page. Real DCAP v4
quotes nest the Quoting Enclave material under a type-6
`QE_REPORT_CERTIFICATION_DATA` header; the parser read the QE report six bytes
Expand Down