DEV Community

VoltageGPU
VoltageGPU

Posted on Originally published at voltagegpu.com

Verify an Intel TDX Quote From Any Cloud in One Command

#linux #security #cloud #tutorial

A TDX quote is the CPU's signed statement that a virtual machine is a genuine Intel TDX trust domain, with its measurements and 64 bytes of data the guest chose. Any provider selling confidential VMs can hand you one. The useful part is checking it yourself, without trusting the provider or its tooling. That takes one command, and it works on a quote from any cloud.

Step 1: get a quote and the tool

This uses a public quote captured on 4 September 2026 inside an Intel TDX VM with one H200, together with the 64-byte report_data the tenant chose (README).

curl -sO https://voltagegpu.com/blog/two-proofs/evidence/quote.bin
curl -sO https://voltagegpu.com/blog/two-proofs/evidence/report_data.bin
pip install "voltage-verify>=0.2.1"
Enter fullscreen mode Exit fullscreen mode

Step 2: verify it against Intel 

voltage-verify quote quote.bin --report-data "$(xxd -p -c 64 report_data.bin)"
Enter fullscreen mode Exit fullscreen mode

What it printed on my machine on 19 October 2026:

[PASS] tdx.structure    TDX quote v4, TEE 0x81, 4936 bytes
[PASS] tdx.report_data  quote report_data equals the expected value
[PASS] tdx.signatures   attestation key, QE binding, QE report and PCK chain verify up to the pinned Intel SGX Root CA
[PASS] tdx.collateral   TCB info and QE identity signed by Intel (Intel PCS, fetched now)
[PASS] tdx.tcb          platform TCB UpToDate, QE UpToDate, TDX_01 UpToDate
[PASS] tdx.revocation   PCK certificate not revoked (57 entries in CRL)
[PASS] tdx.revocation   PCK CA certificate not revoked (0 entries in CRL)

TDX: MRTD eea8b6a814569a52bd1e12f6b869bb2d...  TCB UpToDate  QE UpToDate

RESULT: VERIFIED
Enter fullscreen mode Exit fullscreen mode

Structure first, then your report_data, then the signature chain up to the pinned Intel SGX root. Last, the verifier fetches Intel's current collateral and confirms the platform security level is up to date and nothing in the chain is revoked.

Step 3: see it refuse

The same quote, with a challenge it was not issued for:

voltage-verify quote quote.bin --report-data "$(printf '00%.0s' $(seq 64))"
# [FAIL] tdx.report_data  quote report_data does NOT equal the expected value: not issued for your nonce
# RESULT: NOT VERIFIED (tdx.report_data)
Enter fullscreen mode Exit fullscreen mode

Without network, structure and signatures still verify, but the verifier says what it skipped:

voltage-verify quote quote.bin --offline
# [WARN] tdx.collateral  Intel collateral skipped (--offline): TCB status and revocation not checked
# RESULT: VERIFIED
Enter fullscreen mode Exit fullscreen mode

Step 4: do it on your own TDX guest

On a Linux TDX guest that exposes configfs TSM (kernel 6.7 or later), pick a challenge, write its SHA-512 into a fresh report entry, read the quote back, and verify it on another machine:

NONCE=$(openssl rand -hex 32)
RD=$(printf %s "$NONCE" | sha512sum | cut -d' ' -f1)
sudo mkdir /sys/kernel/config/tsm/report/q1
printf %s "$RD" | xxd -r -p | sudo tee /sys/kernel/config/tsm/report/q1/inblob > /dev/null
sudo cat /sys/kernel/config/tsm/report/q1/outblob > quote.bin

voltage-verify quote quote.bin --report-data "$RD"
Enter fullscreen mode Exit fullscreen mode

What a quote does not prove

It proves a genuine TDX guest on a platform Intel rates, and that the quote was not altered. It does not prove which software runs in the guest unless you compare MRTD and RTMR0 to 3 with a reference you trust, and it says nothing about a GPU: that takes a separate NVIDIA attestation, covered in the bundle tutorial.

Source of the tool: github.com/VoltageGPU/voltage-verify (MIT).

Disclosure: I work on VoltageGPU, where this quote was captured. The verifier is open source and does not trust us.

Top comments (0)