🎁 Get the FREE AI Skills Starter Guide β€” Subscribe β†’
BytesAgainBytesAgain
πŸ¦€ ClawHub

sev-attestation

by @xinyuwang

Perform AMD SEV-SNP remote attestation to cryptographically verify VM identity and integrity. Use when proving a VM is running in a genuine AMD SEV-SNP confidential computing environment, verifying VM integrity before trusting it with secrets, checking SEV-SNP availability, generating attestation reports, validating AMD certificate chains (ARK/ASK/VCEK), or debugging attestation failures.

Versionv1.0.2
Downloads2,145
Stars⭐ 1
TERMINAL
clawhub install sev-attestation

πŸ“– About This Skill


name: sev-attestation description: Perform AMD SEV-SNP remote attestation to cryptographically verify VM identity and integrity. Use when proving a VM is running in a genuine AMD SEV-SNP confidential computing environment, verifying VM integrity before trusting it with secrets, checking SEV-SNP availability, generating attestation reports, validating AMD certificate chains (ARK/ASK/VCEK), or debugging attestation failures.

sev-attestation

AMD SEV-SNP remote attestation for cryptographic VM identity verification.

Description

Perform AMD SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) remote attestation to cryptographically verify VM identity and integrity. Use this skill when:

  • Proving a VM is running in a genuine AMD SEV-SNP confidential computing environment
  • Verifying the integrity of a confidential VM before trusting it with secrets
  • Checking if SEV-SNP is available and properly configured
  • Generating attestation reports for remote verification
  • Validating AMD certificate chains (ARK β†’ ASK β†’ VCEK)
  • Debugging attestation failures or certificate issues
  • Keywords: SEV-SNP, attestation, confidential computing, AMD, VCEK, certificate chain, remote attestation, VM identity, TCB, measurement

    Workflow

    β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
    β”‚                    SEV-SNP Attestation Flow                      β”‚
    β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
                                  β”‚
                                  β–Ό
                        β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
                        β”‚  1. Detection    β”‚
                        β”‚  Is SEV-SNP      β”‚
                        β”‚  available?      β”‚
                        β””β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”˜
                                 β”‚
                  β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
                  β”‚                             β”‚
                  β–Ό                             β–Ό
            β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”                   β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”
            β”‚   YES   β”‚                   β”‚   NO    β”‚
            β””β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”˜                   β””β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”˜
                 β”‚                              β”‚
                 β–Ό                              β–Ό
        β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”             β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
        β”‚ 2. Generate     β”‚             β”‚ Exit with       β”‚
        β”‚    Report       β”‚             β”‚ helpful error   β”‚
        β””β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”˜             β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
                 β”‚
                 β–Ό
        β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
        β”‚ 3. Display      β”‚
        β”‚    Report Info  β”‚
        β””β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”˜
                 β”‚
                 β–Ό
        β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
        β”‚ 4. Fetch AMD    β”‚
        β”‚    Certificates β”‚
        β”‚ (ARK, ASK, VCEK)β”‚
        β””β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”˜
                 β”‚
                 β–Ό
        β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
        β”‚ 5. Verify       β”‚
        β”‚    Cert Chain   β”‚
        β””β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”˜
                 β”‚
                 β–Ό
        β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
        β”‚ 6. Verify       β”‚
        β”‚    Report Sig   β”‚
        β””β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”˜
                 β”‚
                 β–Ό
        β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
        β”‚   PASSED or     β”‚
        β”‚   FAILED        β”‚
        β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
    

    Quick Start

    Check if SEV-SNP is Available

    ./scripts/detect-sev-snp.sh
    

    Run Full Attestation

    ./scripts/full-attestation.sh [output_dir]
    

    This runs the complete 6-step attestation workflow and outputs PASSED or FAILED.

    Individual Steps

    Each step can be run independently for debugging or custom workflows:

    | Script | Purpose | |--------|---------| | scripts/detect-sev-snp.sh | Check SEV-SNP availability | | scripts/generate-report.sh | Generate attestation report with nonce | | scripts/fetch-certificates.sh | Fetch AMD certificates from KDS | | scripts/verify-chain.sh | Verify certificate chain | | scripts/verify-report.sh | Verify report signature |

    Prerequisites

  • snpguest: Rust CLI from virtee/snpguest
  • openssl: For certificate operations
  • curl: For fetching certificates from AMD KDS
  • Root access: Required to access /dev/sev-guest
  • Install snpguest:

    cargo install snpguest
    

    Reference Documentation

  • Report Fields - Attestation report field reference
  • Error Codes - Common errors and troubleshooting
  • Manual Verification - OpenSSL-based verification without snpguest
  • Technical Details

  • AMD KDS URL: https://kdsintf.amd.com
  • Certificate Chain: ARK (self-signed) β†’ ASK β†’ VCEK
  • Report Signature: ECDSA P-384
  • Device: /dev/sev-guest (requires root or sev group membership)
  • πŸ’‘ Examples

    Check if SEV-SNP is Available

    ./scripts/detect-sev-snp.sh
    

    Run Full Attestation

    ./scripts/full-attestation.sh [output_dir]
    

    This runs the complete 6-step attestation workflow and outputs PASSED or FAILED.

    βš™οΈ Configuration

  • snpguest: Rust CLI from virtee/snpguest
  • openssl: For certificate operations
  • curl: For fetching certificates from AMD KDS
  • Root access: Required to access /dev/sev-guest
  • Install snpguest:

    cargo install snpguest