tdx

README

Intel TDX attestation module

Status: experimental v0.x. A pinned quote passes real quote authentication and local-policy validation in deterministic tests. The pinned upstream PCS fixture is deliberately rejected because its TCB levels do not match that quote, so there is still no successful strict collateral/CRL fixture or live TDX run for this change. The module is not production-ready.

This module accepts a raw QuoteV4. Verify checks quote authentication, certificate and PCS collateral, CRL status, local TDX policy, debug state, and the caller-supplied REPORT_DATA. Its default network getter is bounded and restricted to the exact Intel PCS API and certificate origins required for collateral and Root CA CRL retrieval. A deployment may inject a reviewed local collateral getter.

It does not implement ASB, TLS, EAT, or CoRIM. Those concerns stay in the root composition layer.

The root A2A tester's --debug-simple mode uses signed simulated evidence and does not import, invoke, or qualify this module.

Run the hardware-independent checks with:

GOWORK=off go mod tidy -diff
GOWORK=off go mod verify
GOWORK=off go test -race -count=1 ./...
GOWORK=off go vet ./...
../../../scripts/check-attestation-vulnerabilities.sh tdx

go-tdx-guest requires x/crypto/cryptobyte, so the Go vulnerability database also reports the unmaintained x/crypto/openpgp package as the module-only advisory GO-2026-5932. This module does not import openpgp, and no fixed x/crypto version exists for that advisory. The vulnerability gate rejects any future openpgp import before running the package scan. It does not suppress the module-only notice or turn a clean result into a hardware or production-readiness claim.

Live qualification must use the exact target image, launch policy, Intel platform, endorsement path, and collateral environment.

A future strict offline success fixture must capture the quote and all four PCS responses, including issuer-chain headers, as one time-consistent set. Mixing the pinned quote with unrelated or differently dated collateral would create a misleading green test.

Documentation

Overview

Package tdx verifies Intel TDX QuoteV4 evidence independently from the ASB protocol implementation. ASB supplies the expected session REPORT_DATA and treats the returned error as the module appraisal result.

Index

• Variables
• func ParseQuote(evidence []byte) (*tdxpb.QuoteV4, error)
• func ValidateConfig(policy *checkconfig.Config) error
• func Verify(ctx context.Context, evidence, expectedReportData []byte, ...) error
• type RuntimeOptions

Variables

var (
	ErrPolicyRequired = errors.New("tdx module: strict verification policy is required")
	ErrInvalidQuote   = errors.New("tdx module: invalid QuoteV4 evidence")
	ErrBinding        = errors.New("tdx module: REPORT_DATA does not match ASB session binding")
	ErrVerification   = errors.New("tdx module: quote, certificate, collateral, or revocation verification failed")
	ErrValidation     = errors.New("tdx module: quote policy validation failed")
)

Functions

func ParseQuote

func ParseQuote(evidence []byte) (*tdxpb.QuoteV4, error)

ParseQuote parses raw evidence and rejects every format other than QuoteV4.

func ValidateConfig

func ValidateConfig(policy *checkconfig.Config) error

ValidateConfig enforces the strict verification baseline before evidence is accepted.

func Verify

func Verify(ctx context.Context, evidence, expectedReportData []byte, policy *checkconfig.Config, runtime *RuntimeOptions) error

Verify authenticates the quote and collateral, forces ASB's dynamic REPORT_DATA into the local validation policy, and rejects debug-enabled TDs.

Types

type RuntimeOptions

type RuntimeOptions struct {
	Getter tdxtrust.HTTPSGetter
	Now    time.Time
}

RuntimeOptions permits deterministic collateral injection in tests and deployments with a reviewed local collateral service. Nil uses a bounded HTTPS-only getter.