Verify a confidential workspace

The "✓ attested" line inside a workspace is a convenience check run by the page itself. The proof is this independent check, run on your own computer, that needs no Clairwave account and does not talk to Clairwave's servers. It connects to your workspace, asks the processor for a fresh signed report and checks it.

Download

• verify_workspace.py — the check (short; please read it)
• tdx_quote.py — Intel TDX quote parsing and signature chain (pins the Intel SGX Root CA)
• releases.json — the published measurement of every workspace image; the image version is shown in the workspace's red strip

Run

From a computer on the network that launched the workspace (a workspace accepts connections from that address only):

pip install cryptography
python verify_workspace.py <id>.ws.clairwave.com --manifest release-<version>.json

The release files sit next to this page as release-<version>.json and are listed in releases.json. The result is VERIFIED only if every check passes:

1. the TLS certificate is valid for the workspace's name;
2. the report is signed by a genuine Intel TDX processor (certificate chain to Intel's root) and the VM is not a debug VM;
3. the report is fresh (your random number) and names the key of the very TLS connection you are using — the key that encrypts your session lives inside that VM;
4. the boot measurements equal the published image, whose read-only disk is sealed by the root hash it carries;
5. the firmware measurement has Google's published endorsement.

What it does not check yet

Whether the processor's microcode level is current (Intel's TCB collateral), and the signature on Google's firmware endorsement — both values are printed so they can be checked by hand.