Binding TDISP & Platform Attestation Reports for Confidential VMs
Talkat Linux Security Summit North America 2025 · on Friday, 2025-06-27· at 09:55· Bluebird Ballroom (BBB) 3GH·
summary
Problem: a TDISP device attestation report and a platform attestation report are not cryptographically bound, allowing replay of old device reports to a CVM. Proposal: CVM hashes each TDISP device report and extends a TPM NVIndex, records an event log, and returns an NVIndex quote signed by the vTPM attestation key alongside the platform and device evidence. Verifier checks platform evidence, device evidence, and the extend-only NV index quote to prove both originated from the same CVM. Open issues: event log size, reset policy, and access permissions.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:29What confidential computing protects
- 3:21TDISP specification
- 6:57IO in CVMs without TDISP
- 11:29Performance impact without TDISP
- 13:20How TDISP changes IO in CVMs
- 15:46Attestation in confidential computing
- 19:49Platform attestation process
- 24:32TDISP device attestation gap
- 27:33Unbound attestation evidence problem
- 28:21Binding evidence solution
- 31:42Proposal technical details
- 35:21NV index security attributes
- 38:19Open questions and future work
- 40:51Q&A
related talks
30mDevice Attestation in Hardware TEE based Confidential Computing
24mDiscussion: TDISP, VM migration, and paravisors
41mUnifying Confidential Attestation
26mVirtual TPM based attestation for Intel Trust Domain Extensions
15mRemote Attestation in AMD SEV-SNP Confidential VMs
14mUsing DevIDs and TPMs for Node Attestation
42mTPM based attestation - how can we use it for good?
32mToward a standard device attestation token for device assignment