You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The GPU attestation gate landed in #765 and Dstack-TEE/meta-dstack#83. It runs local nvattest before key provisioning, and fails closed if an attached GPU can't attest. That's a good foundation, but a few follow-ups remain before it's a complete, remotely-verifiable trust story. Design context is in #751.
Follow-ups
Commit the attestation result into an RTMR, not report_data. Today it only lands in a file under /run, and the planned binding would put it in report_data. But report_data can be set by any app to any value. So a VM with no GPU could copy a real VM's value and pass, and a verifier couldn't tell the two apart. If dstack-util instead emits a gpu-attestation event before system-ready, the value lands in RTMR3, which is measured and append-only, so KMS and remote verifiers can actually trust it. It also closes a gap we have today: a no-GPU VM with verify_gpu=true currently looks identical to a verified one.
Require CC mode on, and reject DEVTOOLS. We run nvattest with no policy file, so success comes down to the x-nvidia-overall-result claim. That claim proves the GPU is genuine and its measurements match, but it does not require CC mode to be on. That means a GPU in DEVTOOLS mode, where memory encryption is off, can still pass. A small Rego policy that requires CC on and debug off would close this.
Don't let OCSP turn into a boot DoS. Local verify makes a live call to NVIDIA's OCSP endpoint at boot (that's what the chrony step is for). Because the gate is fail-closed, anyone who blocks that endpoint stops every GPU VM from booting. That includes a malicious host, but also an egress-restricted or air-gapped deployment, or plain NVIDIA downtime. Caching or stapling the OCSP response would avoid it.
Add SNP support. The RTMR approach doesn't port to SEV-SNP, because SNP has no runtime measurement register: its identity comes from launch-time HOST_DATA. So SNP will need a vTPM before the same binding works. Worth tracking now, otherwise SNP quietly ships a weaker binding.
Context
The GPU attestation gate landed in #765 and Dstack-TEE/meta-dstack#83. It runs local
nvattestbefore key provisioning, and fails closed if an attached GPU can't attest. That's a good foundation, but a few follow-ups remain before it's a complete, remotely-verifiable trust story. Design context is in #751.Follow-ups
Commit the attestation result into an RTMR, not report_data. Today it only lands in a file under
/run, and the planned binding would put it in report_data. But report_data can be set by any app to any value. So a VM with no GPU could copy a real VM's value and pass, and a verifier couldn't tell the two apart. If dstack-util instead emits agpu-attestationevent beforesystem-ready, the value lands in RTMR3, which is measured and append-only, so KMS and remote verifiers can actually trust it. It also closes a gap we have today: a no-GPU VM withverify_gpu=truecurrently looks identical to a verified one.Require CC mode on, and reject DEVTOOLS. We run
nvattestwith no policy file, so success comes down to thex-nvidia-overall-resultclaim. That claim proves the GPU is genuine and its measurements match, but it does not require CC mode to be on. That means a GPU in DEVTOOLS mode, where memory encryption is off, can still pass. A small Rego policy that requires CC on and debug off would close this.Don't let OCSP turn into a boot DoS. Local verify makes a live call to NVIDIA's OCSP endpoint at boot (that's what the chrony step is for). Because the gate is fail-closed, anyone who blocks that endpoint stops every GPU VM from booting. That includes a malicious host, but also an egress-restricted or air-gapped deployment, or plain NVIDIA downtime. Caching or stapling the OCSP response would avoid it.
Add SNP support. The RTMR approach doesn't port to SEV-SNP, because SNP has no runtime measurement register: its identity comes from launch-time HOST_DATA. So SNP will need a vTPM before the same binding works. Worth tracking now, otherwise SNP quietly ships a weaker binding.
Refs: #765, Dstack-TEE/meta-dstack#83, #751.