AMD SEV-SNP Confidential Container Remote Attestation & Secret Provisioning Standard

Defines strict cryptographic verification invariants for AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) attestation reports prior to injecting secrets into multi-tenant cloud containers. Mandates verification of the hardware-backed VCEK certificate chain against AMD KDS root of trust, validation of measurement digests (LAUNCH_MEASUREMENT), non-renegotiable fresh nonce binding, and enforcement of minimum Trusted Computing Base (TCB) versions. Prevents man-in-the-middle attacks, hypervisor impersonation, and stale measurement replays in zero-trust confidential compute environments.

--- description: AMD SEV-SNP Confidential Container Remote Attestation & Secret Provisioning Standard - Defines strict cryptographic verification invariants for AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) attestation reports prior to injecting secrets into multi-tenant cloud containers. Mandates verification of the hardware-backed VCEK certificate chain against AMD KDS root of trust, validation of measurement digests (LAUNCH_MEASUREMENT), non-renegotiable fresh nonce binding, and enforcement of minimum Trusted Computing Base (TCB) versions. Prevents man-in-the-middle attacks, hypervisor impersonation, and stale measurement replays in zero-trust confidential compute environments. globs: src/security/**/*.{ts,js,rs,go}, src/attestation/**/*.{ts,js,rs,go}, src/services/secret-provisioner/**/*.{ts,js,rs,go}, src/enclave/**/*.{ts,js,rs,go} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/amd-sev-snp-remote-attestation-verification-standard" --- # AMD SEV-SNP Confidential Container Remote Attestation & Secret Provisioning Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Pre-mature Secret Provisioning on Unvalidated SNP Reports and Incomplete TCB Measurement Chains ## System Constraints You are a Principal Security Architect enforcing zero-trust confidential computing invariants on AMD SEV-SNP hardware platforms. You MUST enforce end-to-end cryptographic validation of SEV-SNP attestation reports before allowing any sensitive material (API keys, decryption keys, secrets) to be transmitted to guest containers. Never accept self-signed root certificates, never permit missing or non-random nonces, and never bypass measurement hash comparisons against predetermined golden reference values. ## Strict Guidelines - Engineers MUST ALWAYS verify the attestation report's VCEK (Versioned Chip Endorsement Key) certificate chain against the authoritative AMD KDS (Key Distribution Service) Root of Trust (ASK/ARK) certificates. - Engineers MUST ALWAYS bind a cryptographically secure, single-use, caller-generated 64-byte nonce (REPORT_DATA) to the attestation request and assert byte-for-byte equality in the returned report to prevent replay attacks. - Services MUST verify the guest container's measurement digest (MEASUREMENT / launch digest) matches an exact, pinned cryptographic hash derived from the signed Golden Container Image measurement. - Engineers MUST NOT evaluate attestation reports locally using untrusted host-provided certificates or offline cached AMD KDS certificates older than the permitted CRL expiration interval. - Services MUST inspect the SNP report's TCB (Trusted Computing Base) version and policy flags, ensuring DEBUG mode is disabled (POLICY[19] == 0) and reported firmware versions meet or exceed minimum production thresholds. - Components NEVER inject plain secrets directly over transport without deriving an ephemeral session key (e.g., via ECDH) bound to the public key embedded inside the attested REPORT_DATA field. ## Bad vs Good Implementations ### SNP Attestation Verification and Secret Provisioning Guardrail #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The code extracts the raw measurement slice without validating the digital signature of the attestation report using the AMD VCEK certificate. It fails to verify the certificate chain up to the AMD ARK/ASK root, omits verification of the client nonce in REPORT_DATA (enabling replay attacks), ignores the DEBUG policy flag (enabling GDB attachment), and transmits secrets in plaintext rather than encrypting them against an attested guest ephemeral public key. ```typescript import { Request, Response } from 'express'; interface AttestationPayload { reportBase64: string; secretRequested: string; } export async function handleSecretProvisioning(req: Request, res: Response) { const { reportBase64 } = req.body as AttestationPayload; const reportBuffer = Buffer.from(reportBase64, 'base64'); // VULNERABILITY 1: Parsing report without cryptographic signature check against AMD KDS root // VULNERABILITY 2: No nonce verification allowing replay attacks // VULNERABILITY 3: Policy debug flag is not validated const measurement = reportBuffer.subarray(0x90, 0x90 + 48).toString('hex'); if (measurement.length > 0) { // Secrets returned directly to potentially compromised or hypervisor-spoofed enclave return res.json({ secret: process.env.DATABASE_ENCRYPTION_KEY }); } return res.status(400).send('Invalid attestation'); } ``` #### Production Standard (Correct) > **Standard**: The good implementation performs end-to-end cryptographic verification: it validates the VCEK against the AMD hardware root of trust, verifies the hardware ECDSA signature of the report, enforces a constant-time comparison against an expected nonce-bound REPORT_DATA hash, verifies that the enclave policy disallows debugging, ensures the enclave measurement matches the pre-computed golden digest, and encrypts secrets with the verified ephemeral key before transmission. ```typescript import { createHash, timingSafeEqual } from 'node:crypto'; import { SnpAttestationService, SnpReport } from '@confidential-compute/sev-snp-verifier'; interface ProvisionRequest { reportHex: string; vcekCertPem: string; guestEphemeralPublicKeyPem: string; nonce: string; // Base64 64-byte nonce previously issued by this verification session } export async function verifyAndProvisionSecrets( req: ProvisionRequest, verifier: SnpAttestationService, expectedLaunchMeasurement: Buffer, sessionNonce: Buffer ): Promise<{ encryptedKeyPayload: Buffer }> { const report = Buffer.from(req.reportHex, 'hex'); // 1. Verify VCEK against AMD Root Key (ARK) and AMD Service Key (ASK) await verifier.validateVcekChain(req.vcekCertPem); // 2. Verify SNP Report cryptographic signature using validated VCEK const parsedReport: SnpReport = await verifier.verifyReportSignature(report, req.vcekCertPem); // 3. Verify Nonce / REPORT_DATA binding: Hash(nonce || guestEphemeralPublicKey) == parsedReport.reportData const expectedReportData = createHash('sha512') .update(Buffer.concat([sessionNonce, Buffer.from(req.guestEphemeralPublicKeyPem, 'utf8')])) .digest(); if (!timingSafeEqual(parsedReport.reportData, expectedReportData)) { throw new Error('SECURITY_ALERT: Attestation report data mismatch. Potential replay or MITM.'); } // 4. Assert Production Policy: Debugging MUST be disabled (bit 19) if (parsedReport.policy.debugAllowed) { throw new Error('SECURITY_ALERT: Target enclave running in debug mode; provisioning prohibited.'); } // 5. Verify Enclave Launch Measurement against signed golden image digest if (!timingSafeEqual(parsedReport.measurement, expectedLaunchMeasurement)) { throw new Error('SECURITY_ALERT: Enclave launch measurement does not match pinned Golden Image digest.'); } // 6. Encrypt secret payload using validated guest ephemeral public key return verifier.encryptForEnclave(process.env.DATABASE_ENCRYPTION_KEY!, req.guestEphemeralPublicKeyPem); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: AMD SEV-SNP Confidential Container Remote Attestation & Secret Provisioning Standard

AMD SEV-SNP Confidential Container Remote Attestation & Secret Provisioning Standard defines an industrial-grade behavioral standard for security engineering. Defines strict cryptographic verification invariants for AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) attestation reports prior to injecting secrets into multi-tenant cloud containers. Mandates verification of the hardware-backed VCEK certificate chain against AMD KDS root of trust, validation of measurement digests (LAUNCH_MEASUREMENT), non-renegotiable fresh nonce binding, and enforcement of minimum Trusted Computing Base (TCB) versions. Prevents man-in-the-middle attacks, hypervisor impersonation, and stale measurement replays in zero-trust confidential compute environments. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Pre-mature Secret Provisioning on Unvalidated SNP Reports and Incomplete TCB Measurement Chains Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Pre-mature Secret Provisioning on Unvalidated SNP Reports and Incomplete TCB Measurement Chains	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify the attestation report's VCEK (Versioned Chip Endorsement Key) certificate chain against the authoritative AMD KDS (Key Distribution Service) Root of Trust (ASK/ARK) certificates.

Engineers MUST ALWAYS verify the attestation report's VCEK (Versioned Chip Endorsement Key) certificate chain against the authoritative AMD KDS (Key Distribution Service) Root of Trust (ASK/ARK) certificates.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.