· 06/16/2026 ·
GPU remote attestation with Intel® Trust Authority
Intel and NVIDIA have collaborated to add NVIDIA* GPU TEE remote attestation to Intel® Trust Authority. It's now possible to attest a confidential virtual machine TEE and NVIDIA confidential-computing GPUs in one composite attestation workflow. This article provides an overview of the GPU attestation architecture, the Intel Trust Authority Python Client, CLI, and REST API that support GPU attestation, and examples of GPU and composite attestation JWTs.
Supported NVIDIA GPU architectures
| Architecture | GPU | Notes |
|---|---|---|
| Hopper | H100 Tensor Core* GPU | Single-GPU and multi-GPU attestation. |
| Blackwell | B200 Tensor Core* GPU | Single-GPU and multi-GPU attestation. |
Note
This release supports on-premises hardware and cloud-based GPU attestation from certain CSPs. Support GPU architectures are validated by Intel Trust Authority and its customers, additional architecture may also be supported but currently unverified by Intel Trust Authority.
The GPU as a TEE is a relatively new concept that extends the capabilities of a CPU TEE. Generative artificial intelligence (GAI) and other demanding workloads require hardware acceleration with a GPU to achieve acceptable performance. Many GAI models and parameters are themselves highly-valued intellectual property, and they often process sensitive data. The GPU TEE provides a secure execution environment for these workloads, helping to ensure that the data is protected from unauthorized access or tampering.
However, a GPU on its own is not a complete TEE for confidential computing. The GPU confidential compute solution relies on a confidential VM CPU TEE, enabled by Intel® Trust Domain Extensions (Intel® TDX) 1.x on Intel CPUs. The CPU TEE provides the measurements and attestations needed to establish trust in the GPU. The CPU TEE serves as an orchestrator for securely transferring information to the GPU. This is done through a fully encrypted process. The GPU and confidential VM exchange keys to create an encrypted communications channel.
The Intel Trust Authority Python Client, CLI for Intel TDX and NVIDIA GPU, and Intel Trust Authority REST API currently support two GPU attestation options (verfied by Intel Trust Authority and its customer), and each option is extended with multi-GPU (mGPU) batch attestation support.
- Composite CPU TEE + GPU TEE attestation. The Intel Trust Authority client collects separate evidence from the confidential VM TEE and the GPU driver. The evidence is combined and sent to Intel Trust Authority for verification. Intel Trust Authority verifies the CPU evidence, and the GPU quote is sent to NVIDIA Remote Attestation Service (NRAS) for verification. The resulting attestation JWT issued by Intel Trust Authority contains CPU TEE claims and GPU claims, and other claims from the Intel Trust Authority SaaS service. Composite attestation is the preferred method for confidential computing solutions that include a GPU TEE.
- GPU-only attestation using the Intel Trust Authority client. As described above, GPU-only attestation doesn't provide a complete confidential computing solution.
Both options support multi-GPU batch attestation, which allows a single attestation request to cover up to eight NVIDIA confidential-computing GPUs simultaneously. Multi-GPU attestation follows NRAS V3 token format that includes an overall attestation result and per-device claim details.
GPU attestation architecture
The following diagram is a high-level view of the GPU attestation architecture. The focus is on the relationship among the major components and actors (attester, verifier, & relying party).
The attester comprises the confidential computing (CC) app and related software running in the TD, the Intel TDX-enabled host server, and an NVIDIA GPU (local or remote).
There are two independent verifiers: Intel Trust Authority SaaS service, and NVIDIA Remote Attestation Service (NRAS). NRAS verifies the GPU TEE by comparing the evidence collected from the driver with the so-called "golden measurements" stored in the NVIDIA Reference Integrity Manifest* (RIM) service.
GPU attestation begins when the Intel Trust Authority client GPU TEE adapter calls the NVIDIA SDK API to request evidence for the GPU. The GPU evidence is provided by the NVIDIA GPU driver running on the server where the GPU is installed. The GPU server can be local or remote, but the GPU driver must be running on the same server as the GPU.
When composite attestation (option 1 and 1a on the diagram) is requested, independent evidence is collected for both the Intel TDX TD and the NVIDIA confidential-computing GPU. When an attestation request is made, Intel Trust Authority SaaS verifies the Intel TDX quote as usual and forwards the GPU evidence to the NRAS GPU verification service.
Intel Trust Authority extracts the NRAS JWT from the NRAS API response body, verifies the NRAS JWT certificate, and returns the NRAS JWT embedded as a JSON sub object in the JWT. This method is called composite attestation because it relies on multiple verifiers and and the attestation result includes claims from more than one TEE or device.
Note
When composite attestation with a NVIDIA GPU is requested, the Intel Trust Authority service relies on NRAS to verify the GPU evidence and return a JWT. If NRAS is experiencing uneven performance, timeouts, or is unavailable, an error will occur and Intel Trust Authority won't return an attestation token. If service delay is lengthy, the verifier nonce may expire before an attestation request can be completed. It is recommended to include retry logic in the client application to handle these situations.
When GPU-only attestation (option 2 on the diagram) is requested, the Intel Trust Authority Python Client GPU adapter collects GPU evidence, generates a nonce in NVIDIA 32-byte Hex format, and then sends an attestation request to Intel Trust Authority. Intel Trust Authority's GPU verification sends a request to NVIDIA NRAS to verify the GPU evidence. The NRAS JWT cert is verified, and then the NRAS JWT claims are copied to the "nvgpu":{} section of the JWT issued by Intel Trust Authority.
Composite attestation of both the CPU TEE and the GPU TEE provides a more secure confidential computing solution than GPU-only attestation. The trust model of a GPU TEE relies on the CPU TEE to establish trust in the GPU, and to manage data flow and computations on the secure channel between the CPU and GPU.
Local NVIDIA GPU verifier
Intel Trust Authority can optionally use a local NVIDIA GPU verification service instead of forwarding GPU evidence to the NVIDIA Remote Attestation Service (NRAS) cloud endpoint. When the local verifier is enabled, Intel Trust Authority performs GPU evidence verification using a locally deployed verifier component. The local verifier still relies on NRAS for all verification collaterals, including Reference Integrity Manifests (RIMs) and OCSP certificate status. What it replaces is the NRAS attestation API call, reducing the real-time dependency on NRAS service availability during attestation.
Intel Trust Authority client support for GPU attestation
NVIDIA GPU attestation is supported by the Intel Trust Authority Golang/C/Python Client. The client includes a GPU adapter that collects evidence from the NVIDIA GPU driver (running on the server where the GPU is installed) and sends it to Intel Trust Authority for verification.
golang client
The go-nvgpu package (github.com/intel/trustauthority-client/go-nvgpu) provides a GPU evidence adapter for the Go connector. The adapter uses the NVIDIA Management Library (NVIDIA ML) to communicate with NVIDIA confidential-computing GPUs, collects an attestation report and certificate chain from each supported device on the system, verifies the certificate chain, and returns a GPUEvidence structure ready for submission to Intel Trust Authority.
Supported GPU architectures in the Go client:
- Hopper (H100, H200 series)
- Blackwell (B100, B200 series)
Multi-GPU is supported natively: NewCompositeEvidenceAdapter automatically collects evidence from all supported GPUs on the system and packages them into an evidence_list. To supply an NRAS API key, pass WithNrasApiKey at adapter creation time.
import "github.com/intel/trustauthority-client/go-nvgpu"
adapter := nvgpu.NewCompositeEvidenceAdapter(
nvgpu.WithNrasApiKey("<nras-api-key>"),
)
evidence, err := adapter.GetEvidence(verifierNonce, nil)
if err != nil {
return err
}
GetEvidence returns a *GPUEvidence value. The evidence_list field contains one entry per attested GPU, each with evidence (base64-encoded attestation report), certificate (base64-encoded certificate chain), and firmware_version. Pass the returned evidence to AttestEvidence on the Go connector to request an attestation token from Intel Trust Authority.
C client
Note
The nvgpu adapter (src/nvgpu) in the Intel Trust Authority Client for C collects GPU attestation evidence from all supported NVIDIA GPUs on the system. The adapter uses the NVIDIA Management Library (libnvidia-ml.so) and produces an evidence_list with one entry per attested GPU.
Supported GPU architectures in the C client:
- Hopper (H100, H200 series)
- Blackwell (B100, B200 series)
All GPUs on the system must be of a supported architecture; a single unsupported device will cause an error. Requires Ubuntu 24.04 with the NVIDIA driver and CC mode enabled.
Create an adapter with nvgpu_adapter_new, then collect evidence using the evidence_builder interface:
#include <nvgpu_adapter.h>
evidence_adapter *adapter = NULL;
status = nvgpu_adapter_new(&adapter);
if (STATUS_OK != status)
{
printf("Failed to create NVGPU adapter: 0x%04x\n", status);
return status;
}
// Collect evidence from all supported GPUs on the system.
// The resulting JSON contains an evidence_list array with one entry per GPU.
json_t *evidence_json = json_object();
status = adapter->get_evidence(adapter->ctx, evidence_json, nonce, NULL, 0);
if (STATUS_OK != status)
{
printf("Failed to collect NVGPU evidence: 0x%04x\n", status);
json_decref(evidence_json);
return status;
}
Pass the resulting evidence_json to the connector to request an attestation token from Intel Trust Authority. See the nvgpu_token example in the examples/ directory for a complete working application.
REST API updates
GPU and Intel TDX + GPU attestation uses the /appraisal/v2/attest endpoint of the Intel Trust Authority REST API.
The optional nras_apikey field is a top-level field in the NVIDIA GPU attestation request body. When provided, Intel Trust Authority forwards this key to NRAS when verifying GPU evidence. If nras_apikey is not provided, NRAS does not guarantee service-level availability, which may result in service disruption and request throttling. It is strongly recommended to supply an nras_apikey for production workloads.
Single-GPU attestation request fields
Warning
The single-GPU request fields (evidence, certificate, and gpu_nonce) are deprecated. Customers are directed to use the multi-GPU request fields (evidence_list) instead, which supports single-GPU attestation as well as batch attestation.
For single-GPU attestation using the legacy format, the request body contains the evidence, certificate, and gpu_nonce fields. These fields are mutually exclusive with evidence_list; you cannot use them together in the same request.
Multi-GPU attestation request fields
For multi-GPU (batch) attestation, the request body uses the evidence_list array field. evidence_list is mutually exclusive with the single-GPU evidence field. evidence_list contains json filed array encapsulating evidence and certificate from each invidividual GPU.
Note
The maximum number of GPUs in a single evidence_list request is 8. Submitting both evidence and evidence_list in the same request returns an error. However, evidence_list will take a evidence_list containing only one GPU field to support single-GPU attestation.
Request using evidence will be deprecated in coming releases, and customer are suggested to move to use evidence_list as soon as possible to avoid potencial impact due to token format changes. Please refer to Detailed migration guide
Multi-GPU attestation JWT (NRAS V3 token format)
When evidence_list is used for multi-GPU attestation, NRAS V3 token format will be returned. The top-level nvgpu section contains:
x-nvidia-overall-att-result— A single boolean that summarizes the attestation result across all GPUs in the request. This is the primary field to check in policy for a pass/fail result.claim_details— A JSON object that maps a per-device key (such as"GPU-0","GPU-1") to an individual GPU claim details object containing measurement, RIM validation, and certificate chain results for that device.
For the full list of claims in each per-device entry, see the NVIDIA GPU Claims Reference (V3).
Note
The V3 EAT claim_details structure replaces the flat top-level GPU claims of the V1 token. Existing single-GPU policies that reference input.nvgpu.<claim> directly are not affected; those policies apply only to single-GPU requests. For multi-GPU requests, write policies that access claims through input.nvgpu.claim_details[gpu_key].
In the case of ITA supporting Nvidia Local Verifier, the error handling logic is still being improved, and will match NRAS error handling logic in coming releases.
GPU JWT example
The following sample shows the nvgpu section of an Intel Trust Authority attestation token using the NRAS V3 multi-GPU format, with two attested Blackwell (GB100) GPUs.
Some claim values are truncated for readability, indicated with ellipsis (...). GPU-2 through GPU-7 follow the same per-device structure as GPU-0 and GPU-1.
{
"attester_type": "NVGPU",
"claim_details": {
"GPU-0": {
"dbgstat": "disabled",
"eat_nonce": "dfd20f0d8886e9c3b4a5c2a52f77a2e1c4765e3129bd0f688b45c001af565949",
"hwmodel": "GB100",
"iss": "https://nras.attestation.nvidia.com",
"measres": "success",
"oemid": "5703",
"secboot": true,
"ueid": "837261094523781640293857164029385710264938571204",
"x-nvidia-attestation-warning": null,
"x-nvidia-gpu-arch-check": true,
"x-nvidia-gpu-attestation-report-cert-chain": {
"x-nvidia-cert-expiration-date": "9999-12-31T23:59:59Z",
"x-nvidia-cert-ocsp-nonce-matches": true,
"x-nvidia-cert-ocsp-response-valid": true,
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-revocation-reason": null,
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-attestation-report-cert-chain-fwid-match": true,
"x-nvidia-gpu-attestation-report-nonce-match": true,
"x-nvidia-gpu-attestation-report-parsed": true,
"x-nvidia-gpu-attestation-report-signature-verified": true,
"x-nvidia-gpu-driver-rim-cert-chain": {
"x-nvidia-cert-expiration-date": "2027-12-08T10:36:00Z",
"x-nvidia-cert-ocsp-nonce-matches": true,
"x-nvidia-cert-ocsp-response-valid": true,
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-revocation-reason": null,
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-driver-rim-fetched": true,
"x-nvidia-gpu-driver-rim-measurements-available": true,
"x-nvidia-gpu-driver-rim-schema-validated": true,
"x-nvidia-gpu-driver-rim-signature-verified": true,
"x-nvidia-gpu-driver-rim-version-match": true,
"x-nvidia-gpu-driver-version": "590.48.01",
"x-nvidia-gpu-vbios-index-no-conflict": true,
"x-nvidia-gpu-vbios-rim-cert-chain": {
"x-nvidia-cert-expiration-date": "2027-10-17T21:32:56Z",
"x-nvidia-cert-ocsp-nonce-matches": true,
"x-nvidia-cert-ocsp-response-valid": true,
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-revocation-reason": null,
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-vbios-rim-fetched": true,
"x-nvidia-gpu-vbios-rim-measurements-available": true,
"x-nvidia-gpu-vbios-rim-schema-validated": true,
"x-nvidia-gpu-vbios-rim-signature-verified": true,
"x-nvidia-gpu-vbios-rim-version-match": true,
"x-nvidia-gpu-vbios-version": "97.00.D9.00.35"
},
"GPU-1": {
"dbgstat": "disabled",
"eat_nonce": "dfd20f0d8886e9c3b4a5c2a52f77a2e1c4765e3129bd0f688b45c001af565949",
"hwmodel": "GB100",
"iss": "https://nras.attestation.nvidia.com",
"measres": "success",
"oemid": "5703",
"secboot": true,
"ueid": "312948657023916485720193846572039184657203918465",
"x-nvidia-attestation-warning": null,
"x-nvidia-gpu-arch-check": true,
"x-nvidia-gpu-attestation-report-cert-chain": {
"x-nvidia-cert-expiration-date": "9999-12-31T23:59:59Z",
"x-nvidia-cert-ocsp-nonce-matches": true,
"x-nvidia-cert-ocsp-response-valid": true,
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-revocation-reason": null,
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-attestation-report-cert-chain-fwid-match": true,
"x-nvidia-gpu-attestation-report-nonce-match": true,
"x-nvidia-gpu-attestation-report-parsed": true,
"x-nvidia-gpu-attestation-report-signature-verified": true,
"x-nvidia-gpu-driver-rim-cert-chain": {
"x-nvidia-cert-expiration-date": "2027-12-08T10:36:00Z",
"x-nvidia-cert-ocsp-nonce-matches": true,
"x-nvidia-cert-ocsp-response-valid": true,
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-revocation-reason": null,
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-driver-rim-fetched": true,
"x-nvidia-gpu-driver-rim-measurements-available": true,
"x-nvidia-gpu-driver-rim-schema-validated": true,
"x-nvidia-gpu-driver-rim-signature-verified": true,
"x-nvidia-gpu-driver-rim-version-match": true,
"x-nvidia-gpu-driver-version": "590.48.01",
"x-nvidia-gpu-vbios-index-no-conflict": true,
"x-nvidia-gpu-vbios-rim-cert-chain": {
"x-nvidia-cert-expiration-date": "2027-10-17T21:32:56Z",
"x-nvidia-cert-ocsp-nonce-matches": true,
"x-nvidia-cert-ocsp-response-valid": true,
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-revocation-reason": null,
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-vbios-rim-fetched": true,
"x-nvidia-gpu-vbios-rim-measurements-available": true,
"x-nvidia-gpu-vbios-rim-schema-validated": true,
"x-nvidia-gpu-vbios-rim-signature-verified": true,
"x-nvidia-gpu-vbios-rim-version-match": true,
"x-nvidia-gpu-vbios-version": "97.00.D9.00.35"
}
},
"submods": {
"GPU-0": ["DIGEST", ["SHA-256", "4c6896c6d996cc3f4f2b6be174e8a09b328e620fdf0cb06b746a3096d0431a6f"]],
"GPU-1": ["DIGEST", ["SHA-256", "2ff0272c57b88518439000c84302f5187cc05643d1fd9532cc4948ee32f7d4f9"]]
},
"x-nvidia-overall-att-result": true
}
Composite JWT example
The following sample JWT is the result of a composite attestation with an Intel TDX TD and one or more NVIDIA confidential-computing GPUs. The outer ITA JWT contains two sections: tdx for the Intel TDX claims and nvgpu for the GPU claims. The nvgpu section follows the NRAS V3 token format, containing x-nvidia-overall-att-result, claim_details (per-device) fields as described in the Multi-GPU attestation JWT section.
Some claim values are truncated for readability, indicated with ellipsis (...). GPU-2 through GPU-7 follow the same per-device structure as GPU-0 and GPU-1.
{
"appraisal": {
"method": "default",
"ver": 2
},
"eat_profile": "https://portal.trustauthority.intel.com/eat_profile.html",
"intuse": "generic",
"nvgpu": {
"attester_type": "NVGPU",
"claim_details": {
"GPU-0": {
"dbgstat": "disabled",
"eat_nonce": "dfd20f0d8886e9c3b4a5c2a52f77a2e1c4765e3129bd0f688b45c001af565949",
"hwmodel": "GB100",
"iss": "https://nras.attestation.nvidia.com",
"measres": "success",
"oemid": "5703",
"secboot": true,
"ueid": "837261094523781640293857164029385710264938571204",
"x-nvidia-attestation-warning": null,
"x-nvidia-gpu-arch-check": true,
"x-nvidia-gpu-attestation-report-cert-chain": {
"x-nvidia-cert-expiration-date": "9999-12-31T23:59:59Z",
"x-nvidia-cert-ocsp-nonce-matches": true,
"x-nvidia-cert-ocsp-response-valid": true,
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-revocation-reason": null,
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-attestation-report-cert-chain-fwid-match": true,
"x-nvidia-gpu-attestation-report-nonce-match": true,
"x-nvidia-gpu-attestation-report-parsed": true,
"x-nvidia-gpu-attestation-report-signature-verified": true,
"x-nvidia-gpu-driver-rim-cert-chain": {
"x-nvidia-cert-expiration-date": "2027-12-08T10:36:00Z",
"x-nvidia-cert-ocsp-nonce-matches": true,
"x-nvidia-cert-ocsp-response-valid": true,
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-revocation-reason": null,
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-driver-rim-fetched": true,
"x-nvidia-gpu-driver-rim-measurements-available": true,
"x-nvidia-gpu-driver-rim-schema-validated": true,
"x-nvidia-gpu-driver-rim-signature-verified": true,
"x-nvidia-gpu-driver-rim-version-match": true,
"x-nvidia-gpu-driver-version": "590.48.01",
"x-nvidia-gpu-vbios-index-no-conflict": true,
"x-nvidia-gpu-vbios-rim-cert-chain": {
"x-nvidia-cert-expiration-date": "2027-10-17T21:32:56Z",
"x-nvidia-cert-ocsp-nonce-matches": true,
"x-nvidia-cert-ocsp-response-valid": true,
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-revocation-reason": null,
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-vbios-rim-fetched": true,
"x-nvidia-gpu-vbios-rim-measurements-available": true,
"x-nvidia-gpu-vbios-rim-schema-validated": true,
"x-nvidia-gpu-vbios-rim-signature-verified": true,
"x-nvidia-gpu-vbios-rim-version-match": true,
"x-nvidia-gpu-vbios-version": "97.00.D9.00.35"
},
"GPU-1": {
"dbgstat": "disabled",
"eat_nonce": "dfd20f0d8886e9c3b4a5c2a52f77a2e1c4765e3129bd0f688b45c001af565949",
"hwmodel": "GB100",
"iss": "https://nras.attestation.nvidia.com",
"measres": "success",
"oemid": "5703",
"secboot": true,
"ueid": "312948657023916485720193846572039184657203918465",
"x-nvidia-attestation-warning": null,
"x-nvidia-gpu-arch-check": true,
"x-nvidia-gpu-attestation-report-cert-chain": {
"x-nvidia-cert-expiration-date": "9999-12-31T23:59:59Z",
"x-nvidia-cert-ocsp-nonce-matches": true,
"x-nvidia-cert-ocsp-response-valid": true,
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-revocation-reason": null,
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-attestation-report-cert-chain-fwid-match": true,
"x-nvidia-gpu-attestation-report-nonce-match": true,
"x-nvidia-gpu-attestation-report-parsed": true,
"x-nvidia-gpu-attestation-report-signature-verified": true,
"x-nvidia-gpu-driver-rim-cert-chain": {
"x-nvidia-cert-expiration-date": "2027-12-08T10:36:00Z",
"x-nvidia-cert-ocsp-nonce-matches": true,
"x-nvidia-cert-ocsp-response-valid": true,
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-revocation-reason": null,
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-driver-rim-fetched": true,
"x-nvidia-gpu-driver-rim-measurements-available": true,
"x-nvidia-gpu-driver-rim-schema-validated": true,
"x-nvidia-gpu-driver-rim-signature-verified": true,
"x-nvidia-gpu-driver-rim-version-match": true,
"x-nvidia-gpu-driver-version": "590.48.01",
"x-nvidia-gpu-vbios-index-no-conflict": true,
"x-nvidia-gpu-vbios-rim-cert-chain": {
"x-nvidia-cert-expiration-date": "2027-10-17T21:32:56Z",
"x-nvidia-cert-ocsp-nonce-matches": true,
"x-nvidia-cert-ocsp-response-valid": true,
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-revocation-reason": null,
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-vbios-rim-fetched": true,
"x-nvidia-gpu-vbios-rim-measurements-available": true,
"x-nvidia-gpu-vbios-rim-schema-validated": true,
"x-nvidia-gpu-vbios-rim-signature-verified": true,
"x-nvidia-gpu-vbios-rim-version-match": true,
"x-nvidia-gpu-vbios-version": "97.00.D9.00.35"
}
},
"submods": {
"GPU-0": ["DIGEST", ["SHA-256", "4c6896c6d996cc3f4f2b6be174e8a09b328e620fdf0cb06b746a3096d0431a6f"]],
"GPU-1": ["DIGEST", ["SHA-256", "2ff0272c57b88518439000c84302f5187cc05643d1fd9532cc4948ee32f7d4f9"]]
},
"x-nvidia-overall-att-result": true
},
"tdx": {
"attester_advisory_ids": [
"INTEL-SA-01192",
"INTEL-SA-01245",
"INTEL-SA-01312",
"INTEL-SA-01313",
"INTEL-SA-01314",
"INTEL-SA-01397"
],
"attester_runtime_data": {
"nonce": "aaaaa",
"public-key": "AQABALUKAI9jz55+A22V+f0FPeinIJimJndm..."
},
"attester_tcb_date": "2025-05-14T00:00:00Z",
"attester_tcb_status": "OutOfDate",
"attester_type": "TDX",
"cvm_compliance_status": "not_provided",
"dbgstat": "disabled",
"pce_svn": 11,
"platform_instance_id": "ad547c1cea56d993fb830d5afddba306",
"sgx_tcb_comp_svn": "08080202040100060000000000000000",
"tdx_collateral": {
"fmspc": "00806F050000",
"qeidcerthash": "c550544e4442d9be583a5eddd48df8ba0149dde...",
"qeidcrlhash": "a275a88576a9d9d8a514f03e4d588cedf4f1453...",
"qeidhash": "7dc57bcc263d76c4f39f43dc59f0a0acd92c852...",
"quotehash": "0296e001b1febfbdc7535ab81c91e850523fcb8...",
"tcbevaluationdatanumber": 21,
"tcbinfocerthash": "c550544e4442d9be583a5eddd48df8ba0149dde...",
"tcbinfocrlhash": "a275a88576a9d9d8a514f03e4d588cedf4f1453...",
"tcbinfohash": "5365d02407b09b41af98a81c694f390b14bfd9e..."
},
"tdx_is_debuggable": false,
"tdx_is_migratable": false,
"tdx_mrconfigid": "000000000000000000000000000000000000000000000000000...",
"tdx_mrowner": "000000000000000000000000000000000000000000000000000...",
"tdx_mrownerconfig": "000000000000000000000000000000000000000000000000000...",
"tdx_mrseam": "49b66faa451d19ebbdbe89371b8daf2b65aa3984ec90110343...",
"tdx_mrsignerseam": "000000000000000000000000000000000000000000000000000...",
"tdx_mrtd": "91eb2b44d141d4ece09f0c75c2c53d247a3c68edd7fafe8a35...",
"tdx_report_data": "c70f66cc578e00051c36cc2f6bf30af8130a2d812fd6e959...",
"tdx_rtmr0": "59dc57e1e3029f15034b127f0264a8e6f00db6c178bb087bc...",
"tdx_rtmr1": "70c3be9ff6c2fab010196a5fa1dd04c1bad37a4a1d2531cb5...",
"tdx_rtmr2": "3142d2479ce77c402ce8d67a04a67d57de798fa98748ca5f0...",
"tdx_rtmr3": "000000000000000000000000000000000000000000000000000...",
"tdx_seam_attributes": "0000000000000000",
"tdx_seamsvn": 263,
"tdx_td_attributes": "0000001000000000",
"tdx_td_attributes_debug": false,
"tdx_td_attributes_key_locker": false,
"tdx_td_attributes_migratable": false,
"tdx_td_attributes_perfmon": false,
"tdx_td_attributes_protection_keys": false,
"tdx_td_attributes_septve_disable": true,
"tdx_tee_tcb_svn": "07010800000000000000000000000000",
"tdx_xfam": "e702060000000000"
},
"ver": "2.0.0",
"verifier_instance_ids": [
"a02aa0ee-c849-417c-8413-1ce2579f69f3",
"6b2cc8e7-d41f-499d-ad9a-5007b00eaeac",
"ea248be2-64f5-4454-8b61-f2313202b354",
"0a684fb0-7b11-4556-b5ed-f04a5843f181",
"71ee8253-43c5-48ef-be04-eae636ed0616"
],
"exp": 1781642837,
"jti": "64b78ebb-04bd-4d33-9db8-245196916941",
"iat": 1781642537,
"iss": "https://portal.trustauthority.intel.com",
"nbf": 1781642537
}
Claims usable in policy
The following sample shows nvgpu claims usable in a multi-GPU appraisal policy. Additional claims present in the token may also be accessible in policy.
This sample shows the nvgpu claims usable in a multi-GPU appraisal policy. Additional claims present in the token may also be accessible in policy. Claims such as eat_nonce, iss, oemid, verifier_instance_ids, and intermediate RIM fetch status fields are informational and not recommended for use in policy.
The overall result is false because GPU-1 has RIM version mismatches, illustrating a mixed result that a relying party can inspect per-device.
"nvgpu": {
"x-nvidia-overall-att-result": false,
"claim_details": {
"GPU-0": {
"dbgstat": "disabled",
"hwmodel": "GB100",
"measres": "success",
"secboot": true,
"ueid": "837261094523781640293857164029385710264938571204",
"x-nvidia-attestation-warning": null,
"x-nvidia-gpu-arch-check": true,
"x-nvidia-gpu-attestation-report-cert-chain": {
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-attestation-report-cert-chain-fwid-match": true,
"x-nvidia-gpu-attestation-report-nonce-match": true,
"x-nvidia-gpu-attestation-report-parsed": true,
"x-nvidia-gpu-attestation-report-signature-verified": true,
"x-nvidia-gpu-driver-rim-cert-chain": {
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-driver-rim-measurements-available": true,
"x-nvidia-gpu-driver-rim-schema-validated": true,
"x-nvidia-gpu-driver-rim-signature-verified": true,
"x-nvidia-gpu-driver-rim-version-match": true,
"x-nvidia-gpu-driver-version": "590.48.01",
"x-nvidia-gpu-vbios-index-no-conflict": true,
"x-nvidia-gpu-vbios-rim-cert-chain": {
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-vbios-rim-measurements-available": true,
"x-nvidia-gpu-vbios-rim-schema-validated": true,
"x-nvidia-gpu-vbios-rim-signature-verified": true,
"x-nvidia-gpu-vbios-rim-version-match": true,
"x-nvidia-gpu-vbios-version": "97.00.D9.00.35"
},
"GPU-1": {
"dbgstat": "disabled",
"hwmodel": "GB100",
"measres": "comparison-fail",
"secboot": true,
"ueid": "312948657023916485720193846572039184657203918465",
"x-nvidia-attestation-warning": null,
"x-nvidia-gpu-arch-check": true,
"x-nvidia-gpu-attestation-report-cert-chain": {
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-attestation-report-cert-chain-fwid-match": true,
"x-nvidia-gpu-attestation-report-nonce-match": true,
"x-nvidia-gpu-attestation-report-parsed": true,
"x-nvidia-gpu-attestation-report-signature-verified": true,
"x-nvidia-gpu-driver-rim-cert-chain": {
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-driver-rim-measurements-available": true,
"x-nvidia-gpu-driver-rim-schema-validated": true,
"x-nvidia-gpu-driver-rim-signature-verified": true,
"x-nvidia-gpu-driver-rim-version-match": false,
"x-nvidia-gpu-driver-version": "590.48.01",
"x-nvidia-gpu-vbios-index-no-conflict": true,
"x-nvidia-gpu-vbios-rim-cert-chain": {
"x-nvidia-cert-ocsp-status": "good",
"x-nvidia-cert-status": "valid"
},
"x-nvidia-gpu-vbios-rim-measurements-available": true,
"x-nvidia-gpu-vbios-rim-schema-validated": true,
"x-nvidia-gpu-vbios-rim-signature-verified": true,
"x-nvidia-gpu-vbios-rim-version-match": false,
"x-nvidia-gpu-vbios-version": "97.00.D9.00.35"
}
}
}
This particular token shows a mixed result: GPU-0 attestation passes (measres: "success"), but GPU-1 has measres: "comparison-fail" with RIM version-match failures. A relying party can examine the per-device measres, x-nvidia-gpu-driver-rim-version-match, and x-nvidia-gpu-vbios-rim-version-match claims in claim_details to determine whether each GPU is within acceptable limits for use, or if it should be quarantined or taken offline.
Multi-GPU policy
Multi-GPU policies (for evidence_list requests) access claims through input.nvgpu.claim_details. The object.keys Rego built-in is supported and can be used to iterate over the per-device keys.
Check overall attestation result
Policy that checks the overall multi-GPU attestation result across all devices.
import rego.v1
default match := false
match if {
input.nvgpu["x-nvidia-overall-att-result"] == true
}
Check every GPU's attestation result
Policy that requires every GPU in the batch request to have a valid attestation report with all measurements matched.
import rego.v1
default match := false
match if {
input.nvgpu["x-nvidia-overall-att-result"] == true
every gpu_key in object.keys(input.nvgpu.claim_details) {
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-attestation-report-parsed"] == true
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-attestation-report-signature-verified"] == true
}
}
Check per-GPU RIM validation
Policy that requires every GPU to have both driver and VBIOS RIM validation pass.
import rego.v1
default match := false
match if {
input.nvgpu["x-nvidia-overall-att-result"] == true
every gpu_key in object.keys(input.nvgpu.claim_details) {
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-driver-rim-signature-verified"] == true
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-driver-rim-measurements-available"] == true
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-vbios-rim-signature-verified"] == true
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-vbios-rim-measurements-available"] == true
}
}
Check per-GPU hardware identity
Policy that checks the hardware model and driver version for every GPU in the batch. Update the values to match your expected GPU configuration.
import rego.v1
default match := false
match if {
input.nvgpu["x-nvidia-overall-att-result"] == true
every gpu_key in object.keys(input.nvgpu.claim_details) {
input.nvgpu.claim_details[gpu_key].hwmodel == "GB100"
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-driver-version"] == "590.48.01"
}
}
Example appraisals
This section includes sample appraisal policies that can be used to verify the GPU attestation results. Most of these examples are really fragments meant to be combined for a complete GPU or composite policy. For more information about appraisal policies, see the Appraisal Policy V2 article.
Secure boot
Policy that checks whether Secure Boot* is enabled and all GPU measurements passed on every GPU.
import rego.v1
default match := false
match if {
input.nvgpu["x-nvidia-overall-att-result"] == true
every gpu_key in object.keys(input.nvgpu.claim_details) {
input.nvgpu.claim_details[gpu_key].secboot == true
input.nvgpu.claim_details[gpu_key].measres == "success"
}
}
Validate attestation report
Policy that checks whether the attestation report is valid on every GPU.
import rego.v1
default match := false
match if {
input.nvgpu["x-nvidia-overall-att-result"] == true
every gpu_key in object.keys(input.nvgpu.claim_details) {
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-attestation-report-parsed"] == true
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-attestation-report-signature-verified"] == true
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-attestation-report-nonce-match"] == true
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-attestation-report-cert-chain"]["x-nvidia-cert-status"] == "valid"
}
}
GPU driver RIM
Policy that checks whether the GPU driver RIM is available, valid, and version-matched on every GPU.
import rego.v1
default match := false
match if {
input.nvgpu["x-nvidia-overall-att-result"] == true
every gpu_key in object.keys(input.nvgpu.claim_details) {
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-driver-rim-schema-validated"] == true
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-driver-rim-signature-verified"] == true
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-driver-rim-measurements-available"] == true
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-driver-rim-version-match"] == true
}
}
GPU VBIOS RIM
Policy that checks whether the VBIOS RIM is available, valid, and version-matched on every GPU.
import rego.v1
default match := false
match if {
input.nvgpu["x-nvidia-overall-att-result"] == true
every gpu_key in object.keys(input.nvgpu.claim_details) {
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-vbios-rim-measurements-available"] == true
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-vbios-rim-schema-validated"] == true
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-vbios-rim-signature-verified"] == true
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-vbios-rim-version-match"] == true
}
}
GPU hardware info
Policy that checks the GPU hardware information (driver version, VBIOS version, and hardware model) for every GPU in the batch. Update the values to match your expected GPU configuration.
This example is written in policy v2 format; for more information, see Attestation Policies v2.
import rego.v1
default match := false
match if {
input.nvgpu["x-nvidia-overall-att-result"] == true
every gpu_key in object.keys(input.nvgpu.claim_details) {
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-driver-version"] == "590.48.01"
input.nvgpu.claim_details[gpu_key].hwmodel == "GB100"
input.nvgpu.claim_details[gpu_key]["x-nvidia-gpu-vbios-version"] == "97.00.D9.00.35"
}
}
* Other names and brands may be claimed as the property of others.