AMD SEV-SNP Cryptographic Attestation and Key Release Gatekeeper

--- description: AMD SEV-SNP Cryptographic Attestation and Key Release Gatekeeper - Mandates strict cryptographic verification of AMD SEV-SNP attestation reports prior to releasing tenant master encryption keys to ephemeral enclaves. Requires end-to-end validation of the AMD VCEK certificate chain back to the AMD Root Key (ARK), strict verification of launch measurements against signed golden baselines, and cryptographic binding of an ephemeral session key to REPORT_DATA to prevent relay attacks. globs: src/attestation/**/*.{ts,js}, src/security/**/*.{ts,js}, src/kms/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/amd-sev-snp-attestation-gatekeeper-mandate" --- # AMD SEV-SNP Cryptographic Attestation and Key Release Gatekeeper > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Injecting Master Keys via Unauthenticated Ephemeral Sessions or Incomplete VCEK Chain and Measurement Validation ## System Constraints You are a Principal Security Architect enforcing Confidential Computing Hardware Attestation Gatekeepers using AMD SEV-SNP. Never permit key release without complete verification of the VCEK certificate chain against AMD ARK, explicit matching of launch measurement digests against tamper-proof baselines, and proof of possession via REPORT_DATA binding with fresh challenge nonces. ## Strict Guidelines - Engineers MUST ALWAYS verify the AMD SEV-SNP VCEK certificate path back to the self-signed AMD Root Key (ARK) via the AMD Signing Key (ASK) using valid CRLs fetched from the AMD Key Distribution Service (KDS). - Engineers MUST ALWAYS verify that the attestation report's REPORT_DATA field exactly matches the cryptographic digest of the client's ephemeral public key concatenated with a cryptographically secure, single-use server nonce. - Engineers MUST ALWAYS match the report's MEASUREMENT (launch digest) against an immutable, cryptographically signed list of approved enclave golden digests. - Engineers MUST NEVER inject plaintext master encryption keys; secrets MUST be wrapped using an ephemeral key exchange derived exclusively from the authenticated session key proven in REPORT_DATA. - Services MUST verify the reported TCB (Trusted Computing Base) version and ensure SVN (Security Version Number) meets or exceeds the minimum required threshold without any active revocation flags. ## Bad vs Good Implementations ### AMD SEV-SNP Attestation Verification and Key Release Gatekeeper #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The bad example extracts fields from an unverified attestation report without validating the cryptographic signature against the AMD Root Key. It fails to bind the ephemeral client key and challenge nonce to the hardware-attested REPORT_DATA field, allowing a malicious hypervisor or MITM proxy to replay valid reports and steal tenant master keys. ```typescript import { createCipheriv } from 'crypto'; interface AttestationPayload { rawReport: Buffer; clientPublicKey: Buffer; } export async function releaseMasterKey( payload: AttestationPayload, tenantKey: Buffer ): Promise<Buffer> { // VULNERABILITY 1: Parsing report without verifying VCEK against AMD Root of Trust (ARK) const measurement = payload.rawReport.subarray(0x90, 0xC0); // VULNERABILITY 2: No nonce verification or binding between clientPublicKey and REPORT_DATA // Enables relay and man-in-the-middle attacks const isMeasurementAllowed = measurement.length === 48; if (!isMeasurementAllowed) { throw new Error('Invalid measurement format'); } // VULNERABILITY 3: Direct key delivery encrypted with an unauthenticated public key const cipher = createCipheriv('aes-256-gcm', payload.clientPublicKey.subarray(0, 32), Buffer.alloc(12, 0)); return Buffer.concat([cipher.update(tenantKey), cipher.final(), cipher.getAuthTag()]); } ``` #### Production Standard (Correct) > **Standard**: The good implementation validates the full hardware chain of trust (ARK -> ASK -> VCEK), authenticates the enclave signature, verifies that the hardware report binds the exact session nonce and ephemeral public key via REPORT_DATA in constant time, ensures the launch measurement matches golden baselines, and wraps the key using the verified ephemeral enclave public key. ```typescript import { timingSafeEqual, createHash } from 'crypto'; import { verifySevSnpReport, verifyAmdCertChain } from '@cloud/sev-snp-verifier'; import { wrapKeyForEnclave } from './crypto-envelope'; interface ValidatedEnclaveSession { rawReport: Buffer; vcekCertDer: Buffer; clientEphemeralPubKey: Buffer; sessionNonce: Buffer; } export async function releaseMasterKey( session: ValidatedEnclaveSession, approvedGoldenMeasurements: Set<string>, tenantMasterKey: Buffer ): Promise<Buffer> { // 1. Verify AMD Hardware Root of Trust certificate chain (ARK -> ASK -> VCEK) const isCertChainValid = await verifyAmdCertChain(session.vcekCertDer); if (!isCertChainValid) { throw new SecurityError('VCEK certificate chain verification failed against AMD KDS'); } // 2. Cryptographically verify the raw SEV-SNP attestation report signature using the verified VCEK const parsedReport = await verifySevSnpReport(session.rawReport, session.vcekCertDer); // 3. Prevent replay and MITM: verify REPORT_DATA = SHA-512(sessionNonce || clientEphemeralPubKey) const expectedReportData = createHash('sha512') .update(session.sessionNonce) .update(session.clientEphemeralPubKey) .digest(); if (!timingSafeEqual(parsedReport.reportData, expectedReportData)) { throw new SecurityError('Attestation REPORT_DATA does not match ephemeral session context'); } // 4. Verify Launch Measurement matches an immutable approved baseline const hexMeasurement = parsedReport.measurement.toString('hex'); if (!approvedGoldenMeasurements.has(hexMeasurement)) { throw new SecurityError(`Launch measurement ${hexMeasurement} is not authorized`); } // 5. Enforce minimum hardware TCB version and lack of revocation if (parsedReport.tcbStatus !== 'UpToDate') { throw new SecurityError(`TCB version is compromised or revoked: ${parsedReport.tcbStatus}`); } // 6. Wrap tenant master key strictly targeting the validated enclave ephemeral public key return wrapKeyForEnclave(tenantMasterKey, session.clientEphemeralPubKey); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: AMD SEV-SNP Cryptographic Attestation and Key Release Gatekeeper

AMD SEV-SNP Cryptographic Attestation and Key Release Gatekeeper defines an industrial-grade behavioral standard for security engineering. Mandates strict cryptographic verification of AMD SEV-SNP attestation reports prior to releasing tenant master encryption keys to ephemeral enclaves. Requires end-to-end validation of the AMD VCEK certificate chain back to the AMD Root Key (ARK), strict verification of launch measurements against signed golden baselines, and cryptographic binding of an ephemeral session key to REPORT_DATA to prevent relay attacks. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Injecting Master Keys via Unauthenticated Ephemeral Sessions or Incomplete VCEK Chain and Measurement Validation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Injecting Master Keys via Unauthenticated Ephemeral Sessions or Incomplete VCEK Chain and Measurement Validation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify the AMD SEV-SNP VCEK certificate path back to the self-signed AMD Root Key (ARK) via the AMD Signing Key (ASK) using valid CRLs fetched from the AMD Key Distribution Service (KDS).

Engineers MUST ALWAYS verify the AMD SEV-SNP VCEK certificate path back to the self-signed AMD Root Key (ARK) via the AMD Signing Key (ASK) using valid CRLs fetched from the AMD Key Distribution Service (KDS).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.