Verify ColdVault's hardware attestation yourself AMD SEV-SNP

Don't trust our checkmark. ColdVault's /api/attestation endpoint returns the raw, chip-signed evidence, bound to a nonce you choose. Re-check the AMD signature with Google's go-sev-guest or AMD's snpguest and reach the same verdict — with zero trust in ColdVault's server or this page.

Recipe A — Google go-sev-guest check (recommended, offline)

This is the strongest path: check embeds AMD's real root key, so the whole chain is verified against AMD with nothing taken from ColdVault. The serialized proto we return already contains the full certificate chain, so verification runs fully offline.

0. Generate your OWN nonce — a fresh, unpredictable random value

This is the anti-replay anchor. Use a cryptographic RNG, ≥16 bytes. Never use a counter, a timestamp, or the 8-byte minimum — a predictable nonce lets a pre-generated report pass.

NONCE=$(openssl rand -hex 16)          # 32 random ASCII chars = 32 bytes

1. Fetch the evidence bound to your nonce

curl -sS "https://coldvault.ai/api/attestation?nonce=$NONCE" -o resp.json
jq -r .evidence.attestation_proto_b64 resp.json | base64 -d > attestation.bin

2. Compute the expected REPORT_DATA yourself — do not copy ours

ColdVault binds your nonce as raw bytes, right-zero-padded to 64 bytes, NOT hashed. Recompute it from your own nonce so you never rely on the server's echoed report_data_hex field.

RD=$(python3 -c 'import sys; print(sys.argv[1].encode().ljust(64, b"\x00").hex())' "$NONCE")

3. Install the AMD-rooted checker and verify

go install github.com/google/go-sev-guest/tools/check@v0.14.0

check -in attestation.bin -inform proto \
      -report_data "$RD" \
      -guest_policy 196608 \
      -minimum_tcb 0xde1d000000000004 \
      -minimum_launch_tcb 0xde1d000000000004 \
      -vmpl 0 \
      -network=false -quiet ; echo "exit=$?"

exit=0 means verified — genuine AMD SEV-SNP, signed for your nonce, with zero ColdVault trust. Any other exit code identifies which claim failed (2 = signature, 3 = certificate chain, 4 = revocation, 5 = policy / report_data / TCB / VMPL).

Why each flag (cross-check against check --help)

• -inform proto — input is the serialized attestation (report + VCEK→ASK→ARK). Self-contained, so -network=false verifies fully offline.
• -report_data "$RD" — mandatory. Without it, freshness is unchecked and a replayed/relayed report would pass. With your own fresh nonce, a pre-recorded report cannot contain it (REPORT_DATA is inside the signed region).
• -guest_policy 196608 (0x30000) — confirms SMT on, Debug off, Migration off. (The tool's default 0x20000 has SMT off and would false-fail a genuine report — you must pass this.)
• -minimum_tcb / -minimum_launch_tcb 0xde1d000000000004 — firmware floor (BL=4, TEE=0, SNP=29, μcode=222). These are ≥ floors (anti-rollback).
• -vmpl 0 — the report was produced at the highest privilege level.

Optional hardening: add -network=true -check_crl=true to also check AMD's revocation list. Cross-check independence — verify the bare report so the tool must fetch the chain live from AMD's KDS (proving it roots in AMD regardless of any cert we shipped):

jq -r .evidence.report_b64 resp.json | base64 -d > report.bin
check -in report.bin -inform bin -report_data "$RD" \
      -guest_policy 196608 -minimum_tcb 0xde1d000000000004 -minimum_launch_tcb 0xde1d000000000004 \
      -vmpl 0 -network=true ; echo "exit=$?"

Recipe B — AMD snpguest (cross-check) advanced

Use this to corroborate with a second, independent toolchain. Important: snpguest verify certs only proves the ARK is self-signed — it embeds no AMD root. You MUST add the AMD-rooting step (4) or this path is not trustless.

# 0. Split our cert_chain_pem (order: VCEK, ASK, ARK) into the load-bearing filenames.
mkdir -p certs
jq -r .evidence.cert_chain_pem resp.json | awk '
  /-----BEGIN CERTIFICATE-----/{i++; f=(i==1?"certs/vcek.pem":i==2?"certs/ask.pem":"certs/ark.pem")} {print > f}'
jq -r .evidence.report_b64 resp.json | base64 -d > report.bin
test "$(wc -c < report.bin)" -eq 1184 && echo "report.bin OK (1184-byte ABI report)"

# 1. Chain VCEK->ASK->ARK, and 2. report signature under VCEK:
snpguest verify certs ./certs
snpguest verify attestation ./certs report.bin

# 3. Nonce binding is MANUAL (snpguest never sees your nonce) — compare the SIGNED bytes:
EXPECTED=$(printf '%-128s' "$(printf '%s' "$NONCE" | xxd -p | tr -d '\n')" | tr ' ' 0)
ACTUAL=$(xxd -p -s 80 -l 64 report.bin | tr -d '\n')
[ "$EXPECTED" = "$ACTUAL" ] && echo "nonce bound OK" || { echo "NONCE MISMATCH"; exit 1; }

# 4. ROOT IN AMD (mandatory — 'verify certs' only proves the ARK is self-signed). Pick one:
#    (a) OFFLINE, no fetch-syntax dependency — pin our ARK SHA-256 to AMD's published Milan ARK
#        (get AMD's fingerprint out-of-band from AMD, NOT from ColdVault):
openssl x509 -in certs/ark.pem -fingerprint -sha256 -noout   # compare to AMD's published Milan ARK
#    (b) ONLINE — re-fetch AMD's CA from KDS and confirm our ARK == AMD's. NB: 'snpguest fetch ca'
#        argument order is version-dependent; check `snpguest fetch ca --help` for your build:
snpguest fetch ca pem milan ./kdscerts    # (verify arg order against --help)
diff <(openssl x509 -in certs/ark.pem -fingerprint -sha256 -noout) \
     <(openssl x509 -in kdscerts/ark.pem -fingerprint -sha256 -noout)   # our ARK == AMD's

# 5. Appraisal snpguest does NOT enforce — read via 'snpguest display report report.bin':
#    VMPL == 0 ; Guest Policy Debug == 0 (policy 0x30000) ; TCB >= 0xde1d000000000004

You don't have to trust this page

Every flag above is documented upstream — verify them against go-sev-guest check and the AMD SEV-SNP ABI specification. The verdict depends only on the tool's exit code run with your own nonce — not on anything ColdVault, or this page, asserts.

Convenience: fetch your evidence in the browser

This runs entirely in your browser (a fresh random nonce → /api/attestation → downloads attestation.bin for the recipe above). The trustless path is still your own terminal.

Fetch & download evidence