Prove-ItEnclava verification example · loading…

Live evidence, explained

Don’t trust a badge.
Follow the proof.

This workload shows every value used to bind fresh attestation evidence to your browser request—and clearly separates that binding check from full AMD hardware appraisal.

Run the verification

The protocol

One request, five inspectable steps

Green means this browser observed the step during the current verification. Nothing is hidden behind a single “secure” label.

  1. 01Challenge

    The browser creates 32 unpredictable bytes with WebCrypto.

    nonce
  2. 02Bind

    The domain, nonce and in-TEE proxy key become a CE-v1 transcript.

    SHA-256(transcript)
  3. 03Report

    The attestation path places the derived value in SEV-SNP REPORT_DATA.

    evidence.report_data
  4. 04Recompute

    This page repeats the derivation independently with WebCrypto.

    web/verify.js
  5. 05Compare

    Browser, server and evidence values must agree byte-for-byte.

    A = B = C

The complete trust path

Where the root of trust enters

A verifier starts from an AMD certificate it already trusts, then follows signatures down to this specific report before checking the request binding.

Trusted anchorAMD ARK

The verifier pins AMD’s public root certificate. Trust starts here—not at this website.

IntermediateAMD ASK

The ARK signature authenticates AMD’s SEV signing certificate.

Chip endorsementVCEK

A chip- and TCB-specific certificate chains back to AMD.

Hardware evidenceSNP report

The VCEK verifies the report signature; policy checks its TCB and measurement.

Fresh bindingREPORT_DATA

Commits to this domain, browser nonce and in-TEE keys.

DecisionApp policy

Authorize only when appraisal and request binding both pass.

Independent appraiser: ARK → ASK → VCEK → report signature, TCB and measurement This browser demo: nonce + domain + keys → REPORT_DATA equality

Read the verdict correctly

Binding proof ≠ hardware appraisal

This browser verifies here

  • The challenge is fresh for this request
  • The domain and in-TEE proxy SPKI are in the transcript
  • The evidence REPORT_DATA matches the browser derivation
  • A mismatched or replayed binding fails closed

A production appraiser must also verify

  • AMD VCEK certificate chain and report signature
  • Chip TCB level, revocation and endorsement freshness
  • Launch measurement and allowed image identity
  • Your organization’s authorization policy

Honest verdict: this demo proves the freshness and consistency of the binding. Treat the hardware as trusted only after an independent appraiser accepts the signed evidence and policy.

Infrastructure isolation

The user workload is treated as hostile

Application code does not enforce this boundary. CAP, Kata/SEV-SNP, Kubernetes and Cilium do.

PublicBrowser

Sends HTTPS and a fresh nonce. Receives public evidence only.

Confidential VM
Untrusted app payloadnon-root · read-only rootfs
all capabilities dropped
no service-account token
Platform sidecarsattestation · encrypted storage
tenant TLS · boot policy
Enclava infrastructureDefault deny

Only explicit DNS, KBS, certificate and control-plane paths are reachable.

A signed app image cannot grant itself host access, Kubernetes credentials or broader egress. Those controls belong to the platform and must remain enforced even when the payload is malicious.

Live inventory

What this instance reports

Loading runtime facts…

Try it

Run the binding check

Watch the protocol above turn green as each observed value is validated.

A new nonce is generated every time. The response stays visible below so you can inspect the exact evidence and claims used by the demo.

Verify independently

The tenant page, its binding demo, and any appraiser verdict are untrusted claims. Download fresh raw evidence here, then open the independently obtained CAP HTML/WASM verifier with your own policy—or use enclava verify for live TLS-channel binding.

Get the CAP verifier

Developer blueprint

Expose verification without inventing a trust badge

Keep evidence, policy and verdict separate in your API. Let users inspect why a decision passed.

1

Challenge from the verifier

Create the nonce in the browser or independent verifier—not inside the workload being checked.

2

Return evidence, not a boolean

Include the nonce, binding inputs, raw signed evidence, endorsements, identity claims and policy result.

3

Gate action on appraisal

Authorize only after signature, TCB, freshness, measurement and binding checks all pass.

Minimal same-origin binding checkbrowser.js
import { randomNonceBytes, bytesToBase64, hexToBytes, reportDataHex } from "/verify.js";

const nonce = randomNonceBytes(32);
const response = await fetch("/api/verify", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ nonce_b64: bytesToBase64(nonce), domain: location.hostname })
}).then(r => r.json());

const browserValue = await reportDataHex(
  location.hostname,
  nonce,
  hexToBytes(response.leaf_spki_sha256),
  hexToBytes(response.receipt_pubkey_sha256)
);

if (!response.match || browserValue !== response.evidence_report_data_hex) {
  throw new Error("attestation binding failed");
}

// Production: independently appraise response.evidence and endorsements,
// then enforce the expected measurement/image policy before authorizing.
Inspect the raw verification response 
Run live verification to populate this response.