improve

Signed-off-by: Ming-Wei Shih <[email protected]>

Author: mingweishih

articles/confidential-computing/guest-attestation-confidential-vms-design.md

@@ -6,7 +6,7 @@ ms.author: mishih
 ms.service: azure-virtual-machines
 ms.subservice: azure-confidential-computing
 ms.topic: conceptual
-ms.date: 05/21/2024
+ms.date: 02/06/2025
 ms.custom: template-concept
 ---
 
@@ -20,18 +20,18 @@ Azure confidential VMs utilize a vTPM-based design for the guest attestation. Th
 
 ## Attestation Flow
 
-The guest attestation process involves two main steps: evidence generation and evidence verification. The Azure confidential VM generates vTPM evidence, which is then verified by a trusted party (e.g., [Microsoft Azure Attestation (MAA)](https://azure.microsoft.com/products/azure-attestation)).
+The guest attestation process involves two main steps: evidence generation and evidence verification. A user requests the Azure confidential VM to generate vTPM evidence and then send the evidence to a trusted party (for example, [Microsoft Azure Attestation (MAA)](https://azure.microsoft.com/products/azure-attestation)) for verification.
 
 A relying party, such as [Azure Key Vault Premium](../security/fundamentals/key-management.md) or [Azure Key Vault Managed HSM](/azure/key-vault/managed-hsm/overview), can assess the trustworthiness of the Azure confidential VM based on the verification results. If the VM is deemed trustworthy, the relying party can securely provision secrets to the VM, using mechanisms like [Secure Key Release](concept-skr-attestation.md).
 
 ### vTPM Evidence
 
-A vTPM evidence consists of a TPM quote and endorsements used to verify the quote, as outlined below:
+A vTPM evidence consists of a TPM quote and endorsements used to verify the quote, as outlined in the rest of the section.
 - TPM Quote
-  - A standard TPM quote that is generated by `TPM2_Quote` command defined by TPM 2.0 specification.
-  - Includes a list of Platform Configuration Registers (PCRs) that captures the measurements of the guest OS (e.g., boot process).
+  - A standard TPM quote that is the output of `TPM2_Quote` command defined by TPM 2.0 specification.
+  - Includes a list of Platform Configuration Registers (PCRs) that captures the measurements of the guest OS (for example, boot process).
   - The usage of PCRs conforms to Linux and Windows standards (each having its usage definition).
-  - The quote is signed by vTPM attestation private key (AK); i.e., AK is specified as the signing key in the `TPM2_Quote` command.
+  - The quote is signed by vTPM attestation private key (AK); that is, AK is specified as the signing key in the `TPM2_Quote` command.
 
 - TPM Event Log
   - An event log stored in the system that can be used to reproduce PCR values in the TPM quote.
@@ -42,7 +42,12 @@ A vTPM evidence consists of a TPM quote and endorsements used to verify the quot
   - Backed by hardware (the vTPM attestation public key, AK public, is captured in the hardware report).
 
 - Hardware Report
-  - Generated and signed by the hardware, capturing the AK public, the measurement of Microsoft-built guest paravisor (where the vTPM is hosted), and the hardware information (learn more in [Confidential VMs on Azure](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/confidential-vms-on-azure/ba-p/3836282)).
+  - Generated and signed by the hardware.
+  - Capturing the following information
+    - AK public
+    - The measurement of Microsoft-built guest paravisor where the vTPM runs
+      - Learn more in [Confidential VMs on Azure](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/confidential-vms-on-azure/ba-p/3836282)).
+    - Hardware information
   - Refer to AMD SEV-SNP and Intel TDX specifications for more detail.
 
 - Hardware Vendor Certificate Chain
@@ -60,7 +65,7 @@ A vTPM evidence consists of a TPM quote and endorsements used to verify the quot
 
 ### How is vTPM Evidence verified?
 
-The verifier ([Microsoft Azure Attestation (MAA)](https://azure.microsoft.com/products/azure-attestation)) verified the vTPM evidence based on the trusted chain, as shown in the figure below. Successful verification implies that the attested Azure confidential VM is trustworthy and protected by the hardware.
+The verifier ([Microsoft Azure Attestation (MAA)](https://azure.microsoft.com/products/azure-attestation)) verified the vTPM evidence based on the trusted chain, as shown in the following figure. Successful verification implies that the attested Azure confidential VM is trustworthy and protected by the hardware.
 
 ![Figure of vTPM-based Evidence Trust Chain](media/guest-attestation-confidential-vms-design/azure-cvm-trusted-chain.png)