create-evda 0.1.9 → 0.1.10

package/lib/tdx-attestation.mjs

@@ -0,0 +1,412 @@
+// Is the VM the phone is about to talk to an Intel TDX confidential VM running EVÐA's image, with
+// debug off, on a patched platform, and holding the TLS key this connection uses?
+// (HQ-2083, Spec 08 section 8: "What the client checks before sending anything".)
+//
+// The phone runs this before it sends a hosted EVÐA anything. The claim it backs is "EVÐA's operators
+// cannot read your record". It does not back "no one can": physical attacks on the server (TEE.fail,
+// DDRop) sit outside what a quote can prove. This file is the reference the Swift port follows, and
+// its tests run against a real production quote with its chain to Intel's real root, so the port can
+// replay the same fixture.
+//
+// What it checks, all offline. Collateral is passed in and nothing here touches the network:
+//   1. the quote is a TDX quote v4 with an ECDSA P-256 attestation key and Intel's QE vendor id;
+//   2. the attestation key signs the header and TD report body;
+//   3. the PCK leaf signs the QE report, and the leaf chains through Intel's PCK CA to the pinned
+//      Intel SGX root (lib/tdx-trust.json), every certificate valid at `now`;
+//   4. the QE report's data is SHA-256(attestation key || QE auth data), so the key that signed the
+//      quote is the one the QE vouched for;
+//   5. the QE is Intel's (QE identity: MRSIGNER, ISVPRODID, masked attributes and MISCSELECT), and
+//      Intel's TCB info for this FMSPC puts the platform at a level the policy allows; both
+//      documents are signed by Intel's TCB signing key, chained to the same root, and current at `now`;
+//   6. the TD's debug bit is off;
+//   7. MRTD and RTMR0 to RTMR3 equal the expected set;
+//   8. the nonce is one this phone issued, unused, and young enough;
+//   9. REPORTDATA equals reportDataFor(nonce, tlsPublicKey), which binds the quote to the TLS key the
+//      phone then pins.
+//
+// The binding, exactly: REPORTDATA (64 bytes) = SHA-512( "EVDA-TDX-REPORTDATA-v1" || 0x00 ||
+// nonce (32 bytes) || SPKI DER of the TLS public key ). The nonce has a fixed length and SPKI DER
+// carries its own length, so the concatenation is unambiguous. The VM computes the same value with
+// the same function when it asks the TDX module for a quote.
+//
+// Not checked here yet: certificate revocation (Intel's PCK and root CRLs), quote v5 (refused as
+// unknown rather than half-checked), the TD relaunch advice v5 quotes carry, and whether the expected
+// measurements are themselves in Sigstore's log (lib/measurement-log.mjs checks a digest; tying the
+// expected MRTD and RTMRs to a logged statement is a later slice).
+//
+// Every failure returns { ok: false, reason } in words; nothing a quote contains can make it throw.
+
+import { createHash, createPublicKey, KeyObject, randomBytes, timingSafeEqual, verify as verifySig, X509Certificate } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { derTlv as tlv, derChildren as children, derOid as oid } from "./measurement-log.mjs";
+
+export const TDX_TRUST = JSON.parse(readFileSync(new URL("./tdx-trust.json", import.meta.url), "utf8"));
+
+/** The domain tag in front of every REPORTDATA preimage. */
+export const REPORTDATA_TAG = "EVDA-TDX-REPORTDATA-v1";
+
+/** The measurement registers a policy must name, each 48 bytes as 96 lowercase hex characters. */
+export const MEASUREMENT_NAMES = Object.freeze(["mrtd", "rtmr0", "rtmr1", "rtmr2", "rtmr3"]);
+
+const HEADER_LEN = 48;
+const BODY_LEN = 584;
+const QE_REPORT_LEN = 384;
+const TEE_TDX = 0x81;
+const ATT_KEY_ECDSA_P256 = 2;
+const CERT_QE_REPORT = 6;
+const CERT_PCK_CHAIN = 5;
+const OID_SGX_EXT = "1.2.840.113741.1.13.1";
+const OID_SGX_TCB = `${OID_SGX_EXT}.2`;
+const OID_SGX_FMSPC = `${OID_SGX_EXT}.4`;
+
+const fail = (reason) => ({ ok: false, reason });
+const hex = (b) => Buffer.from(b).toString("hex");
+const sha256 = (b) => createHash("sha256").update(b).digest();
+
+// ─── the binding ─────────────────────────────────────────────────────────────────────────────────
+
+const spkiDer = (key) => {
+  if (Buffer.isBuffer(key) || key instanceof Uint8Array) return createPublicKey({ key: Buffer.from(key), format: "der", type: "spki" }).export({ type: "spki", format: "der" });
+  if (key instanceof KeyObject && key.type === "public") return key.export({ type: "spki", format: "der" });
+  return createPublicKey(key).export({ type: "spki", format: "der" });
+};
+
+/** The 64 bytes a TD must put in REPORTDATA to bind `nonce` (32 bytes) and `tlsPublicKey` to its quote. */
+export function reportDataFor(nonce, tlsPublicKey) {
+  const n = Buffer.from(nonce);
+  if (n.length !== 32) throw new Error("the nonce must be 32 bytes");
+  return createHash("sha512").update(Buffer.concat([Buffer.from(REPORTDATA_TAG, "ascii"), Buffer.from([0]), n, spkiDer(tlsPublicKey)])).digest();
+}
+
+/**
+ * The phone's record of the nonces it has issued. A nonce is good once, within `ttlMs` of issue.
+ * `take` returns null when the nonce is fresh (and spends it), or a reason in words.
+ */
+export function createNonceBook({ ttlMs = 60_000 } = {}) {
+  const issued = new Map();
+  const spent = new Set();
+  return {
+    issue(at = Date.now()) {
+      const n = randomBytes(32);
+      issued.set(hex(n), at);
+      return n;
+    },
+    take(nonce, at = Date.now()) {
+      const key = hex(nonce ?? []);
+      if (spent.has(key)) return "the nonce was already used";
+      if (!issued.has(key)) return "the nonce was not issued by this phone";
+      const issuedAt = issued.get(key);
+      issued.delete(key);
+      spent.add(key);
+      if (at - issuedAt > ttlMs || at < issuedAt) return `the nonce is stale (issued ${Math.round((at - issuedAt) / 1000)}s ago, limit ${ttlMs / 1000}s)`;
+      return null;
+    },
+  };
+}
+
+// ─── parsing ─────────────────────────────────────────────────────────────────────────────────────
+
+/** Splits a TDX quote v4 into its parts. Throws on any length that does not add up. */
+export function parseTdxQuote(raw) {
+  const q = Buffer.from(raw);
+  if (q.length < HEADER_LEN + 4) throw new Error("the quote is shorter than its header");
+  const version = q.readUInt16LE(0);
+  if (version !== 4) throw new Error(`quote version ${version} is not understood (only 4)`);
+  const header = {
+    version,
+    attestationKeyType: q.readUInt16LE(2),
+    teeType: q.readUInt32LE(4),
+    qeVendorId: hex(q.subarray(12, 28)),
+  };
+  if (q.length < HEADER_LEN + BODY_LEN + 4) throw new Error("the quote is truncated in its TD report body");
+  const b = q.subarray(HEADER_LEN, HEADER_LEN + BODY_LEN);
+  const at = (o, n) => b.subarray(o, o + n);
+  const body = {
+    teeTcbSvn: at(0, 16),
+    mrSeam: hex(at(16, 48)),
+    seamAttributes: hex(at(112, 8)),
+    tdAttributes: at(120, 8),
+    xfam: hex(at(128, 8)),
+    mrtd: hex(at(136, 48)),
+    mrConfigId: hex(at(184, 48)),
+    mrOwner: hex(at(232, 48)),
+    mrOwnerConfig: hex(at(280, 48)),
+    rtmr0: hex(at(328, 48)),
+    rtmr1: hex(at(376, 48)),
+    rtmr2: hex(at(424, 48)),
+    rtmr3: hex(at(472, 48)),
+    reportData: at(520, 64),
+  };
+  const signedLen = HEADER_LEN + BODY_LEN;
+  const sigLen = q.readUInt32LE(signedLen);
+  const s = q.subarray(signedLen + 4);
+  if (s.length < sigLen) throw new Error("the quote is truncated in its signature data");
+  if (sigLen < 64 + 64 + 6) throw new Error("the quote's signature data is too short");
+  const quoteSignature = s.subarray(0, 64);
+  const attestationKey = s.subarray(64, 128);
+  const certType = s.readUInt16LE(128);
+  const certLen = s.readUInt32LE(130);
+  if (certType !== CERT_QE_REPORT) throw new Error(`certification data type ${certType} is not a QE report (6)`);
+  const c = s.subarray(134, 134 + certLen);
+  if (c.length !== certLen || 134 + certLen > sigLen) throw new Error("the quote is truncated in its certification data");
+  if (c.length < QE_REPORT_LEN + 64 + 2) throw new Error("the QE report certification data is too short");
+  const qeReport = c.subarray(0, QE_REPORT_LEN);
+  const qeReportSignature = c.subarray(QE_REPORT_LEN, QE_REPORT_LEN + 64);
+  const authLen = c.readUInt16LE(QE_REPORT_LEN + 64);
+  let o = QE_REPORT_LEN + 66;
+  if (o + authLen + 6 > c.length) throw new Error("the quote is truncated in its QE auth data");
+  const qeAuthData = c.subarray(o, o + authLen);
+  o += authLen;
+  const innerType = c.readUInt16LE(o);
+  const innerLen = c.readUInt32LE(o + 2);
+  if (innerType !== CERT_PCK_CHAIN) throw new Error(`the QE's certification data type ${innerType} is not a PCK chain (5)`);
+  const chainBytes = c.subarray(o + 6, o + 6 + innerLen);
+  if (chainBytes.length !== innerLen) throw new Error("the quote is truncated in its PCK chain");
+  const r = qeReport;
+  return {
+    header,
+    body,
+    signed: q.subarray(0, signedLen),
+    quoteSignature,
+    attestationKey,
+    qeReport: {
+      raw: qeReport,
+      miscSelect: r.readUInt32LE(16),
+      attributes: r.subarray(48, 64),
+      mrSigner: hex(r.subarray(128, 160)),
+      isvProdId: r.readUInt16LE(256),
+      isvSvn: r.readUInt16LE(258),
+      reportData: r.subarray(320, 384),
+    },
+    qeReportSignature,
+    qeAuthData,
+    pckChainPem: chainBytes.toString("utf8").replace(/\0+$/, ""),
+  };
+}
+
+const pemCerts = (pem) => (String(pem).match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? []).map((p) => new X509Certificate(p));
+
+const uint = (buf) => { let v = 0; for (const x of buf) v = v * 256 + x; return v; };
+
+/** The SGX TCB component SVNs, PCESVN and FMSPC from a PCK certificate's Intel extension. */
+export function pckExtensions(der) {
+  const buf = Buffer.from(der);
+  const tbs = children(buf, tlv(buf, 0))[0];
+  const extWrap = children(buf, tbs).find((c) => c.tag === 0xa3);
+  if (!extWrap) throw new Error("the PCK certificate has no extensions");
+  for (const ext of children(buf, children(buf, extWrap)[0])) {
+    const parts = children(buf, ext);
+    if (oid(buf.subarray(parts[0].start, parts[0].end)) !== OID_SGX_EXT) continue;
+    const value = parts.at(-1);
+    const raw = buf.subarray(value.start, value.end);
+    const out = { cpuSvn: [], pceSvn: null, fmspc: null };
+    for (const item of children(raw, tlv(raw, 0))) {
+      const [idNode, valNode] = children(raw, item);
+      const id = oid(raw.subarray(idNode.start, idNode.end));
+      if (id === OID_SGX_FMSPC) out.fmspc = hex(raw.subarray(valNode.start, valNode.end));
+      if (id === OID_SGX_TCB) {
+        for (const comp of children(raw, valNode)) {
+          const [cid, cval] = children(raw, comp);
+          const n = Number(oid(raw.subarray(cid.start, cid.end)).split(".").at(-1));
+          if (n >= 1 && n <= 16) out.cpuSvn[n - 1] = uint(raw.subarray(cval.start, cval.end));
+          if (n === 17) out.pceSvn = uint(raw.subarray(cval.start, cval.end));
+        }
+      }
+    }
+    if (out.cpuSvn.filter((v) => v !== undefined).length !== 16 || out.pceSvn === null || !out.fmspc) throw new Error("the PCK certificate's SGX extension is incomplete");
+    return out;
+  }
+  throw new Error("the PCK certificate has no SGX extension");
+}
+
+// ─── signatures and chains ───────────────────────────────────────────────────────────────────────
+
+const rawP256 = (xy) => createPublicKey({ key: { kty: "EC", crv: "P-256", x: xy.subarray(0, 32).toString("base64url"), y: xy.subarray(32, 64).toString("base64url") }, format: "jwk" });
+const p1363 = (data, key, sig) => verifySig("sha256", data, { key, dsaEncoding: "ieee-p1363" }, sig);
+
+function checkChainToRoot(certs, root, at, what) {
+  const all = [...certs, root];
+  for (let i = 0; i < all.length; i++) {
+    const issuer = all[Math.min(i + 1, all.length - 1)];
+    if (!all[i].checkIssued(issuer) || !all[i].verify(issuer.publicKey)) return `the ${what} chain does not reach the pinned Intel root (breaks at ${all[i].subject.split("\n").find((l) => l.startsWith("CN=")) ?? "a certificate"})`;
+    if (at < new Date(all[i].validFrom) || at > new Date(all[i].validTo)) return `a certificate in the ${what} chain is not valid at ${at.toISOString()}`;
+    if (i > 0 && !all[i].ca) return `the ${what} chain has a non-CA certificate as an issuer`;
+  }
+  return null;
+}
+
+/** Splits an Intel PCS response into the exact signed bytes, the parsed document and the signature. */
+function signedDocument(text, field) {
+  const t = String(text ?? "").replace(/\s+$/, "");
+  const m = new RegExp(`^\\{"${field}":([\\s\\S]+),"signature":"([0-9a-fA-F]{128})"\\}$`).exec(t);
+  if (!m) return null;
+  return { body: Buffer.from(m[1], "utf8"), doc: JSON.parse(m[1]), signature: Buffer.from(m[2], "hex") };
+}
+
+function checkCollateralDoc({ text, chainPem, field, root, at, what }) {
+  const d = signedDocument(text, field);
+  if (!d) return { error: `the ${what} is not an Intel PCS response` };
+  const certs = pemCerts(chainPem);
+  if (certs.length === 0) return { error: `the ${what} has no issuer chain` };
+  const signer = certs[0];
+  const chainProblem = checkChainToRoot(certs.filter((c) => !c.raw.equals(root.raw)), root, at, what);
+  if (chainProblem) return { error: chainProblem };
+  if (!p1363(d.body, signer.publicKey, d.signature)) return { error: `the ${what} signature does not verify under Intel's TCB signing key` };
+  const issue = Date.parse(d.doc.issueDate);
+  const next = Date.parse(d.doc.nextUpdate);
+  if (!(issue <= at.getTime() && at.getTime() <= next)) return { error: `the ${what} is not current at ${at.toISOString()} (valid ${d.doc.issueDate} to ${d.doc.nextUpdate})` };
+  return { doc: d.doc };
+}
+
+const masked = (value, mask) => Buffer.from(value.map((b, i) => b & mask[i]));
+
+// Intel's TCB level algorithm (the PCS TDX TCB info spec, as go-tdx-guest implements it): the first
+// level, in Intel's descending order, that the PCK's SGX SVNs, its PCESVN and the TD's TEE_TCB_SVN all
+// meet. When TEE_TCB_SVN[1] names a TDX module version, indexes 0 and 1 are judged instead by the
+// matching TDX module identity.
+function matchTcbLevel(tcbInfo, pck, teeTcbSvn) {
+  const from = teeTcbSvn[1] > 0 ? 2 : 0;
+  for (const level of tcbInfo.tcbLevels ?? []) {
+    const sgx = level.tcb?.sgxtcbcomponents ?? [];
+    const tdx = level.tcb?.tdxtcbcomponents ?? [];
+    if (sgx.length !== 16 || tdx.length !== 16) continue;
+    if (!pck.cpuSvn.every((v, i) => v >= sgx[i].svn)) continue;
+    if (pck.pceSvn < level.tcb.pcesvn) continue;
+    if (!teeTcbSvn.every((v, i) => i < from || v >= tdx[i].svn)) continue;
+    return level;
+  }
+  return null;
+}
+
+function matchModuleLevel(tcbInfo, teeTcbSvn) {
+  const id = `TDX_${teeTcbSvn[1].toString(16).padStart(2, "0").toUpperCase()}`;
+  const identity = (tcbInfo.tdxModuleIdentities ?? []).find((m) => String(m.id).toUpperCase() === id);
+  if (!identity) return { error: `Intel's TCB info has no identity for TDX module ${id}` };
+  const level = (identity.tcbLevels ?? []).find((l) => teeTcbSvn[0] >= l.tcb?.isvsvn);
+  if (!level) return { error: `TDX module ${id} at SVN ${teeTcbSvn[0]} matches no level Intel lists` };
+  return { id, level };
+}
+
+/**
+ * Verifies a TDX quote's signatures, its chain to the pinned Intel root, the QE's identity and the
+ * platform's TCB level against Intel's signed collateral. Policy on the TD itself (debug, measurements,
+ * nonce, TLS binding) is verifyTdxAttestation's.
+ *
+ * collateral: { tcbInfo, tcbInfoIssuerChain, qeIdentity, qeIdentityIssuerChain } as Intel PCS serves them.
+ * minTcb: { statuses: ["UpToDate", ...], tcbEvaluationDataNumber } (statuses defaults to UpToDate only).
+ */
+export function verifyTdxQuote({ quote, collateral, minTcb, now, trust = TDX_TRUST } = {}) {
+  try {
+    return checkQuote({ quote, collateral, minTcb, now, trust });
+  } catch (err) {
+    return fail(`the quote could not be read: ${err.message}`);
+  }
+}
+
+function checkQuote({ quote, collateral, minTcb, now, trust }) {
+  if (!quote) return fail("there is no quote");
+  if (now === undefined) return fail("no time was given to check certificates and collateral against");
+  if (!collateral?.tcbInfo || !collateral?.qeIdentity) return fail("no Intel collateral was given, so the TCB cannot be judged");
+  if (!minTcb || !Number.isSafeInteger(minTcb.tcbEvaluationDataNumber)) return fail("no minimum TCB was named");
+  const at = new Date(now);
+  const q = parseTdxQuote(quote);
+
+  // 1. What kind of quote this is.
+  if (q.header.teeType !== TEE_TDX) return fail(`the quote is for TEE type 0x${q.header.teeType.toString(16)}, not TDX`);
+  if (q.header.attestationKeyType !== ATT_KEY_ECDSA_P256) return fail(`attestation key type ${q.header.attestationKeyType} is not ECDSA P-256`);
+  if (q.header.qeVendorId !== trust.intel.qeVendorId) return fail("the quote is not from Intel's quoting enclave");
+
+  // 2. The attestation key signed the header and the TD report.
+  if (!p1363(q.signed, rawP256(q.attestationKey), q.quoteSignature)) return fail("the quote signature does not verify under its attestation key");
+
+  // 3. The PCK leaf signed the QE report, and chains to the pinned Intel root.
+  const root = new X509Certificate(Buffer.from(trust.intel.rootDer, "base64"));
+  const certs = pemCerts(q.pckChainPem);
+  if (certs.length < 2) return fail("the quote's PCK chain is incomplete");
+  const chain = certs.filter((c) => !c.raw.equals(root.raw));
+  if (chain.length !== 2) return fail("the quote's PCK chain does not end at the pinned Intel root");
+  const chainProblem = checkChainToRoot(chain, root, at, "PCK");
+  if (chainProblem) return fail(chainProblem);
+  const pck = chain[0];
+  if (pck.ca) return fail("the PCK certificate is a CA");
+  if (!p1363(q.qeReport.raw, pck.publicKey, q.qeReportSignature)) return fail("the QE report signature does not verify under the PCK certificate");
+
+  // 4. The QE vouched for this attestation key.
+  const want = Buffer.concat([sha256(Buffer.concat([q.attestationKey, q.qeAuthData])), Buffer.alloc(32)]);
+  if (!want.equals(q.qeReport.reportData)) return fail("the QE report does not bind the attestation key that signed the quote");
+
+  // 5. Intel's collateral: the QE is Intel's, and the platform's TCB level is one the policy allows.
+  const qe = checkCollateralDoc({ text: collateral.qeIdentity, chainPem: collateral.qeIdentityIssuerChain, field: "enclaveIdentity", root, at, what: "QE identity" });
+  if (qe.error) return fail(qe.error);
+  const id = qe.doc;
+  if (id.id !== "TD_QE") return fail(`the QE identity is for ${id.id}, not TD_QE`);
+  if ((q.qeReport.miscSelect & parseInt(id.miscselectMask, 16)) !== parseInt(id.miscselect, 16)) return fail("the QE's MISCSELECT does not match Intel's QE identity");
+  if (!masked([...q.qeReport.attributes], Buffer.from(id.attributesMask, "hex")).equals(Buffer.from(id.attributes, "hex"))) return fail("the QE's attributes do not match Intel's QE identity");
+  if (q.qeReport.mrSigner !== id.mrsigner.toLowerCase()) return fail("the QE was not signed by Intel (MRSIGNER differs)");
+  if (q.qeReport.isvProdId !== id.isvprodid) return fail("the QE's product id does not match Intel's QE identity");
+  const qeLevel = (id.tcbLevels ?? []).find((l) => l.tcb?.isvsvn <= q.qeReport.isvSvn);
+  if (qeLevel?.tcbStatus !== "UpToDate") return fail(`the QE's TCB is ${qeLevel?.tcbStatus ?? "not in Intel's list"}`);
+
+  const ti = checkCollateralDoc({ text: collateral.tcbInfo, chainPem: collateral.tcbInfoIssuerChain, field: "tcbInfo", root, at, what: "TCB info" });
+  if (ti.error) return fail(ti.error);
+  const tcbInfo = ti.doc;
+  if (tcbInfo.id !== "TDX" || tcbInfo.version !== 3) return fail("the TCB info is not TDX TCB info version 3");
+  const ext = pckExtensions(pck.raw);
+  if (tcbInfo.fmspc.toLowerCase() !== ext.fmspc) return fail(`the TCB info is for FMSPC ${tcbInfo.fmspc}, and this platform is ${ext.fmspc}`);
+  const teeTcbSvn = [...q.body.teeTcbSvn];
+  if (tcbInfo.tcbEvaluationDataNumber < minTcb.tcbEvaluationDataNumber) return fail(`Intel's TCB evaluation ${tcbInfo.tcbEvaluationDataNumber} is older than the minimum ${minTcb.tcbEvaluationDataNumber}`);
+  const level = matchTcbLevel(tcbInfo, ext, teeTcbSvn);
+  if (!level) return fail("the platform matches no TCB level in Intel's TCB info, so it is below every level Intel supports");
+  const statuses = minTcb.statuses ?? ["UpToDate"];
+  if (!statuses.includes(level.tcbStatus)) return fail(`the platform's TCB is ${level.tcbStatus} (${level.tcbDate}), below the minimum (${statuses.join(" or ")})`);
+  let module = null;
+  if (teeTcbSvn[1] > 0) {
+    const m = matchModuleLevel(tcbInfo, teeTcbSvn);
+    if (m.error) return fail(m.error);
+    if (!statuses.includes(m.level.tcbStatus)) return fail(`TDX module ${m.id} is ${m.level.tcbStatus}, below the minimum (${statuses.join(" or ")})`);
+    module = { id: m.id, status: m.level.tcbStatus };
+  }
+
+  return {
+    ok: true,
+    body: q.body,
+    tcb: { status: level.tcbStatus, date: level.tcbDate, evaluationDataNumber: tcbInfo.tcbEvaluationDataNumber, fmspc: ext.fmspc, module, advisoryIds: level.advisoryIDs ?? [] },
+  };
+}
+
+/**
+ * The phone's whole check before it sends a hosted EVÐA anything. Returns { ok: true, measurements,
+ * tcb, tlsPublicKeySha256 } (the hash is the key the phone pins), or { ok: false, reason }.
+ *
+ * nonce: the 32 bytes the phone sent; nonces: the createNonceBook that issued it (spent here, pass or fail).
+ * tlsPublicKey: the TLS server key of this connection (KeyObject, PEM, or SPKI DER).
+ * expected: { mrtd, rtmr0, rtmr1, rtmr2, rtmr3 } as hex. Every one must be named.
+ */
+export function verifyTdxAttestation({ quote, nonce, nonces, tlsPublicKey, expected, minTcb, collateral, now, trust = TDX_TRUST } = {}) {
+  try {
+    if (!nonces?.take) return fail("no nonce book was given, so freshness cannot be checked");
+    const at = now === undefined ? undefined : new Date(now).getTime();
+    const stale = nonces.take(nonce, at);
+    if (stale) return fail(stale);
+    if (!tlsPublicKey) return fail("no TLS key was given, so the quote cannot be bound to this connection");
+    if (!expected || MEASUREMENT_NAMES.some((n) => !/^[0-9a-f]{96}$/.test(expected[n] ?? ""))) return fail(`the expected measurements must name ${MEASUREMENT_NAMES.join(", ")} as 96 hex characters each`);
+
+    const r = verifyTdxQuote({ quote, collateral, minTcb, now, trust });
+    if (!r.ok) return r;
+
+    // 6. Debug off. TDATTRIBUTES bit 0 is TUD.DEBUG: a debug TD lets the host read its memory.
+    if (r.body.tdAttributes[0] & 1) return fail("the TD runs with debug on, so its host can read its memory");
+
+    // 7. The code is the code expected.
+    for (const n of MEASUREMENT_NAMES) if (r.body[n] !== expected[n]) return fail(`${n.toUpperCase()} is ${r.body[n].slice(0, 16)}..., not the expected ${expected[n].slice(0, 16)}...`);
+
+    // 9. The quote is for this nonce and this TLS key.
+    const want = reportDataFor(nonce, tlsPublicKey);
+    if (!timingSafeEqual(want, r.body.reportData)) return fail("REPORTDATA does not bind this nonce and this TLS key");
+
+    const measurements = Object.fromEntries(MEASUREMENT_NAMES.map((n) => [n, r.body[n]]));
+    return { ok: true, measurements, tcb: r.tcb, tlsPublicKeySha256: sha256(spkiDer(tlsPublicKey)).toString("hex") };
+  } catch (err) {
+    return fail(`the attestation could not be checked: ${err.message}`);
+  }
+}

package/lib/tdx-trust.json

@@ -0,0 +1,10 @@
+{
+  "_comment": "The roots a phone trusts for an Intel TDX quote (HQ-2083). Fetched 2026-10-18 from Intel and checked equal to the root go-tdx-guest pins (verify/trusted_root.pem).",
+  "intel": {
+    "source": "https://certificates.trustedservices.intel.com/Intel_SGX_Provisioning_Certification_RootCA.cer",
+    "subject": "CN=Intel SGX Root CA, O=Intel Corporation, L=Santa Clara, ST=CA, C=US",
+    "sha256": "44a0196b2b99f889b8e149e95b807a350e7424964399e885a7cbb8ccfab674d3",
+    "rootDer": "MIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIwaDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYTAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi71OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOBuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SVUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYIKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwgAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=",
+    "qeVendorId": "939a7233f79c4ca9940a0db3957f0607"
+  }
+}