|
| 1 | +--- |
| 2 | +title: Azure Confidential VM guest attestation design detail |
| 3 | +description: Learn about the design detail of the guest attestation for Azure confidential virtual machines. |
| 4 | +author: mishih |
| 5 | +ms.author: mishih |
| 6 | +ms.service: azure-virtual-machines |
| 7 | +ms.subservice: azure-confidential-computing |
| 8 | +ms.topic: conceptual |
| 9 | +ms.date: 02/06/2025 |
| 10 | +ms.custom: template-concept |
| 11 | +--- |
| 12 | + |
| 13 | +# Confidential VM Guest Attestation Design Detail |
| 14 | + |
| 15 | +This document provides a detailed overview of the [Azure confidential VM Guest Attestation](guest-attestation-confidential-vms.md) design. |
| 16 | + |
| 17 | +## vTPM-Based Design |
| 18 | + |
| 19 | +Azure confidential virtual machines (VMs) utilize a vTPM-based design for the guest attestation. The approach ensures a consistent interface across guest operating systems (Linux and Windows) and hardware platforms (AMD SEV-SNP and Intel TDX). |
| 20 | + |
| 21 | +## Attestation Flow |
| 22 | + |
| 23 | +The guest attestation process involves two main steps: evidence generation and evidence verification. A user requests the Azure confidential VM to generate vTPM evidence and then send the evidence to a trusted party (for example, [Microsoft Azure Attestation (MAA)](https://azure.microsoft.com/products/azure-attestation)) for verification. |
| 24 | + |
| 25 | +A relying party, such as [Azure Key Vault Premium](../security/fundamentals/key-management.md) or [Azure Key Vault Managed HSM](/azure/key-vault/managed-hsm/overview), can assess the trustworthiness of the Azure confidential VM based on the verification results. If the VM is deemed trustworthy, the relying party can securely provision secrets to the VM, using mechanisms like [Secure Key Release](concept-skr-attestation.md). |
| 26 | + |
| 27 | +### vTPM Evidence |
| 28 | + |
| 29 | +A vTPM evidence consists of a TPM quote and endorsements used to verify the quote, as outlined in the rest of the section. |
| 30 | +- TPM Quote |
| 31 | + - A standard TPM quote that is the output of `TPM2_Quote` command defined by TPM 2.0 specification. |
| 32 | + - Includes a list of Platform Configuration Registers (PCRs) that captures the measurements of the guest OS (for example, boot process). |
| 33 | + - The usage of PCRs conforms to Linux and Windows standards (each having its usage definition). |
| 34 | + - Signed by vTPM attestation private key (AK); that is, AK is specified as the signing key in the `TPM2_Quote` command. |
| 35 | + |
| 36 | +- TPM Event Log |
| 37 | + - An event log stored in the system that can be used to reproduce PCR values in the TPM quote. |
| 38 | + - Refer to [TPM specification](https://trustedcomputinggroup.org/wp-content/uploads/TCG-Guidance-Integrity-Measurements-Event-Log-Processing_v1_r0p118_24feb2022-1.pdf) for more detail. |
| 39 | + |
| 40 | +- vTPM AK Certificate |
| 41 | + - Issued by Azure (signed by Azure CA). |
| 42 | + - Backed by hardware (the vTPM attestation public key, AK public, is captured in the hardware report). |
| 43 | + |
| 44 | +- Hardware Report |
| 45 | + - Generated and signed by the hardware. |
| 46 | + - Capture the following information |
| 47 | + - AK public |
| 48 | + - The measurement of Microsoft-built guest paravisor where the vTPM runs |
| 49 | + - Learn more in [Confidential VMs on Azure](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/confidential-vms-on-azure/ba-p/3836282)). |
| 50 | + - Hardware information |
| 51 | + - Refer to AMD SEV-SNP and Intel TDX specifications for more detail. |
| 52 | + |
| 53 | +- Hardware Vendor Certificate Chain |
| 54 | + - Issued by hardware vendor (AMD and Intel) to certify the signature of the hardware report. |
| 55 | + - AMD SEV-SNP: Versioned Chip Endorsement Key (VCEK) Certificates |
| 56 | + - Intel TDX: Provisioning Certificate Key (PCK) Certificates |
| 57 | + |
| 58 | +### What are being covered by a vTPM Evidence? |
| 59 | + |
| 60 | +| Component | Covered by | |
| 61 | +| :--- | :--- | |
| 62 | +| Guest OS | TPM Quote (PCRs) | |
| 63 | +| UEFI | Hardware Report | |
| 64 | +| Guest Paravisor (including vTPM) | Hardware Report | |
| 65 | + |
| 66 | +### How is vTPM Evidence verified? |
| 67 | + |
| 68 | +The verifier ([Microsoft Azure Attestation (MAA)](https://azure.microsoft.com/products/azure-attestation)) verified the vTPM evidence based on the trusted chain, as shown in the following figure. Successful verification implies that the attested Azure confidential VM is trustworthy and protected by the hardware. |
| 69 | + |
| 70 | + |
| 71 | + |
| 72 | +## Developer's Reference |
| 73 | + |
| 74 | +This section provides a reference to the vTPM-based guest attestation design used by Azure confidential VM. |
| 75 | + |
| 76 | +### Azure-Reserved TPM NV Indexes |
| 77 | + |
| 78 | +| Name | NV Index | Size (bytes) | Description | |
| 79 | +| :--- | :--- | :--- | :--- | |
| 80 | +| Attestation Report | 0x01400001 | 2600 | Azure-defined format with the hardware report embedded. | |
| 81 | +| Report Data | 0x01400002 | 64 | The report data to be included in the Runtime Data. | |
| 82 | +| vTPM AK Cert | 0x01C101D0 | 4096 | The certificate used to verify the TPM Quote signed by the vTPM AK. | |
| 83 | +| vTPM AK | 0x81000003 | Depending on the key type | The key used to sign the TPM Quote. | |
| 84 | + |
| 85 | +Refer to [Azure Confidential VMs attestation guidance & FAQ](https://github.com/Azure/confidential-computing-cvm-guest-attestation/blob/main/cvm-guest-attestation.md) for sample TPM commands. |
| 86 | + |
| 87 | +### Attestation Report Format |
| 88 | + |
| 89 | +#### Attestation Report |
| 90 | + |
| 91 | +| Name | Offset (bytes) | Size (bytes) | Description | |
| 92 | +| :--- | :--- | :--- | :--- | |
| 93 | +| Header | 0 | 32 | The report header (not endorsed by the hardware report). | |
| 94 | +| Report Payload | 32 | 1184 | The hardware report. | |
| 95 | +| Runtime Data | 1216 | variable length | The runtime data includes claims endorsed by the hardware report. | |
| 96 | + |
| 97 | + |
| 98 | +#### Header |
| 99 | + |
| 100 | +| Name | Offset (bytes) | Size (bytes) | Description | |
| 101 | +| :--- | :--- | :--- | :--- | |
| 102 | +| Signature | 0 | 4 | Embedded signature. Expected: 0x414c4348 (`HCLA`). | |
| 103 | +| Version | 4 | 4 | Format version. Expected: 2. |
| 104 | +| Report Size | 8 | 4 | Size of the Report Payload. Expected: 1184 (AMD SEV-SNP), 1024 (Intel TDX). | |
| 105 | +| Request Type | 12 | 4 | Azure-specific usage of the attestation report. Expected: 2. | |
| 106 | +| Status | 16 | 4 | Reserved. | |
| 107 | +| Reserved | 20 | 12 | Reserved. | |
| 108 | + |
| 109 | +#### Report Payload |
| 110 | + |
| 111 | +The report generated by the hardware (AMD SEV-SNP or Intel TDX). The report_data field of the report captures the hash of the Runtime Claims in the Runtime Data. Refer to specifications from hardware vendors for more detail. |
| 112 | + |
| 113 | +#### Runtime Data |
| 114 | + |
| 115 | +| Name | Offset (bytes) | Size (bytes) | Description | Measured | |
| 116 | +| :--- | :--- | :--- | :--- | :--- | |
| 117 | +| Data Size | 0 | 4 | The size of Runtime Claims. | No | |
| 118 | +| Version | 4 | 4 | Format version. Expected: 1. | No | |
| 119 | +| Report Type | 8 | 4 | The type of hardware report. Expected: 2 (AMD SEV-SNP), 4 (Intel TDX) | No | |
| 120 | +| Hash Type | 12 | 4 | The algorithm used to hash the runtime data. The hash value is captured in the report_data field of the hardware report. Expected: 1 (SHA-256), 2 (SHA-384), 3 (SHA-512) | No | |
| 121 | +| Runtime Claims | 16 | variable length | The runtime claims in JSON format. | Yes | |
| 122 | + |
| 123 | +#### Runtime Claims |
| 124 | + |
| 125 | +| JSON Field | Description | |
| 126 | +| :--- | :--- | |
| 127 | +| keys | An array of keys in JWK format. Expected `kid`: `HCLAkPub` (vTPM AK public), `HCLEkPub` (vTPM EK public). | |
| 128 | +| vm_configuration | Selective Azure confidential VM configuration. | |
| 129 | +| user_data | 64-byte data (HEX string) read from `0x01400002` NV index (Report Data). | |
| 130 | + |
| 131 | +Example |
| 132 | + |
| 133 | +```JSON |
| 134 | +{ |
| 135 | + "keys": [ |
| 136 | + { |
| 137 | + "kid": "HCLAkPub", |
| 138 | + "key_ops": [ |
| 139 | + "sign" |
| 140 | + ], |
| 141 | + "kty": "RSA", |
| 142 | + "e": "AQAB", |
| 143 | + "n": "rAipdAAArL6V1FNnSQ-39i3VH-a8PuOeVRo2VpecspDWbJNmgHJ4-VGGFEx4sdVbvDC6fyo_VM2ebE-_AKxTmrNVEr-KIZveJMD_vlOqvMvjtllsWwA-vsRfpqiduvQdFcdCvyHzfxBRHYqdmxgKq-3QI-XBbZv9cCMMMPHkNp4mWkyahjQxXVJVwB1egCrJGKSk1bRXlP1dXNG_Pe4-W5O-YEGRKdLIA31G0Yh8VBnrEUCAMjDAuh6fncMkwdMVskI5Ta-kJgGw4GepIj6_smIyYhxg3o8Ik4qPntxj1TrV0bVW2IiNMLHoM67y1ErOir7bv00xqgqouFodI-vM3Q" |
| 144 | + }, |
| 145 | + { |
| 146 | + "kid": "HCLEkPub", |
| 147 | + "key_ops": [ |
| 148 | + "encrypt" |
| 149 | + ], |
| 150 | + "kty": "RSA", |
| 151 | + "e": "AQAB", |
| 152 | + "n": "m3AfPAAA-_HY3M_-x4bQbr0p2nkvAgig1mENl-BColvqq0aKKAqIHr-DFQ9-iB2z7EzhYVon5R7Nc1jzqBsmxahE8uaQfD-sp8bWOtbvy4V9nAqLY4HOwfxlJ99cEOOpxNXfCNesYOk8T0ntG05w7oBRjFw0LMVKS-1S3j5-oMnNnpJoo7rX5hNM8JVpxEuVa1IOf1NmvRey6wjwSHbjUay_IMUTAq1wzpx8wo_hjeY4JMd0Ka1ewLjJDaTQSpSxZI36ujyR6EGho0FBXSKN-9W9DAXkO8-RKuLUrmTXA6ETJRYApMuYGiUDCk1Y5zQTQsyWS6pLjnf2mg2tEntZZw" |
| 153 | + } |
| 154 | + ], |
| 155 | + "vm-configuration": { |
| 156 | + "root-cert-thumbprint": "", |
| 157 | + "console-enabled": true, |
| 158 | + "secure-boot": true, |
| 159 | + "tpm-enabled": true, |
| 160 | + "tpm-persisted": true, |
| 161 | + "vmUniqueId": "68dc0ac0-2ed9-4b2a-a03e-4953e416d939" |
| 162 | + }, |
| 163 | + "user-data": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" |
| 164 | +} |
| 165 | +``` |
| 166 | + |
| 167 | +## Next Steps |
| 168 | + |
| 169 | +- [Learn more about the guest attestation APIs](guest-attestation-confidential-vms.md) |
| 170 | +- [Learn to use a sample application with the guest attestation APIs](guest-attestation-example.md) |
| 171 | +- [Learn how to use Microsoft Defender for Cloud integration with confidential VMs with guest attestation installed](guest-attestation-defender-for-cloud.md) |
| 172 | +- [Learn about Azure confidential VMs](confidential-vm-overview.md) |
0 commit comments