sev-attestation
by @xinyuwang
Perform AMD SEV-SNP remote attestation to cryptographically verify VM identity and integrity. Use when proving a VM is running in a genuine AMD SEV-SNP confidential computing environment, verifying VM integrity before trusting it with secrets, checking SEV-SNP availability, generating attestation reports, validating AMD certificate chains (ARK/ASK/VCEK), or debugging attestation failures.
clawhub install sev-attestationπ About This Skill
name: sev-attestation description: Perform AMD SEV-SNP remote attestation to cryptographically verify VM identity and integrity. Use when proving a VM is running in a genuine AMD SEV-SNP confidential computing environment, verifying VM integrity before trusting it with secrets, checking SEV-SNP availability, generating attestation reports, validating AMD certificate chains (ARK/ASK/VCEK), or debugging attestation failures.
sev-attestation
AMD SEV-SNP remote attestation for cryptographic VM identity verification.
Description
Perform AMD SEV-SNP (Secure Encrypted Virtualization - Secure Nested Paging) remote attestation to cryptographically verify VM identity and integrity. Use this skill when:
Keywords: SEV-SNP, attestation, confidential computing, AMD, VCEK, certificate chain, remote attestation, VM identity, TCB, measurement
Workflow
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β SEV-SNP Attestation Flow β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β
βΌ
βββββββββββββββββββ
β 1. Detection β
β Is SEV-SNP β
β available? β
ββββββββββ¬βββββββββ
β
ββββββββββββββββ΄βββββββββββββββ
β β
βΌ βΌ
βββββββββββ βββββββββββ
β YES β β NO β
ββββββ¬βββββ ββββββ¬βββββ
β β
βΌ βΌ
βββββββββββββββββββ βββββββββββββββββββ
β 2. Generate β β Exit with β
β Report β β helpful error β
ββββββββββ¬βββββββββ βββββββββββββββββββ
β
βΌ
βββββββββββββββββββ
β 3. Display β
β Report Info β
ββββββββββ¬βββββββββ
β
βΌ
βββββββββββββββββββ
β 4. Fetch AMD β
β Certificates β
β (ARK, ASK, VCEK)β
ββββββββββ¬βββββββββ
β
βΌ
βββββββββββββββββββ
β 5. Verify β
β Cert Chain β
ββββββββββ¬βββββββββ
β
βΌ
βββββββββββββββββββ
β 6. Verify β
β Report Sig β
ββββββββββ¬βββββββββ
β
βΌ
βββββββββββββββββββ
β PASSED or β
β FAILED β
βββββββββββββββββββ
Quick Start
Check if SEV-SNP is Available
./scripts/detect-sev-snp.sh
Run Full Attestation
./scripts/full-attestation.sh [output_dir]
This runs the complete 6-step attestation workflow and outputs PASSED or FAILED.
Individual Steps
Each step can be run independently for debugging or custom workflows:
| Script | Purpose |
|--------|---------|
| scripts/detect-sev-snp.sh | Check SEV-SNP availability |
| scripts/generate-report.sh | Generate attestation report with nonce |
| scripts/fetch-certificates.sh | Fetch AMD certificates from KDS |
| scripts/verify-chain.sh | Verify certificate chain |
| scripts/verify-report.sh | Verify report signature |
Prerequisites
/dev/sev-guestInstall snpguest:
cargo install snpguest
Reference Documentation
Technical Details
https://kdsintf.amd.com/dev/sev-guest (requires root or sev group membership)π‘ Examples
Check if SEV-SNP is Available
./scripts/detect-sev-snp.sh
Run Full Attestation
./scripts/full-attestation.sh [output_dir]
This runs the complete 6-step attestation workflow and outputs PASSED or FAILED.
βοΈ Configuration
/dev/sev-guestInstall snpguest:
cargo install snpguest