# A confidential run on TDX hardware, 2026-10-21

The report-data binding of SPEC §7.6 on genuine Intel silicon, with the PCK
anchor derived from the quote's own certificate chain checked to Intel's
root, and the run verified by a party other than the host.

## What ran

- **Platform:** a confidential VM with Intel TDX (`c3-standard-4`, kernel
  `7.0.0-1014-gcp`), created for the run and deleted after it.
- **Inside the guest:** the reference host
  ([`confidential_run_tdx`](../../../sandbox-rs/crates/sandbox-runtime/examples/confidential_run_tdx.rs)).
  - It took quotes through `configfs-tsm` (provider `tdx_guest`).
  - It derived the anchor from a probe quote's PCK chain, checked to Intel's
    root, which the verifier's side uploaded rather than the guest fetching it.
  - It sealed an S6 run whose `report_data` binds the unit, the receipt, the
    outcome and a 32-byte challenge ([`challenge.hex`](challenge.hex)).
- **The quote:** DCAP version 4, TEE type `0x81`. The interface returns it in
  an 8000-byte buffer, 4935 bytes of quote followed by padding. It travels in
  the attestation as `tee.report_hex`.

The quote's certification data carries three certificates:

```text
CN=Intel SGX PCK Certificate   issued by CN=Intel SGX PCK Platform CA
CN=Intel SGX PCK Platform CA   issued by CN=Intel SGX Root CA
CN=Intel SGX Root CA           self-signed
```

The root it carries is byte-identical to Intel's published root
([`intel-root.der`](intel-root.der)), whose SHA-256 fingerprint is
`44:A0:19:6B:2B:99:F8:89:B8:E1:49:E9:5B:80:7A:35:0E:74:24:96:43:99:E8:85:A7:CB:B8:CC:FA:B6:74:D3`.
Compare it with the one Intel publishes, not with this file.

## What it shows

Verified away from the guest, from these files alone:

```text
cd ../../../sandbox-rs
cargo run -p sandbox-runtime --example verify_run -- \
  ../proof/hardware/2026-10-21-tdx/attestation.json \
  "$(cat ../proof/hardware/2026-10-21-tdx/challenge.hex)" \
  ../proof/hardware/2026-10-21-tdx/intel-root.der
```

- The quote's PCK chain checks to Intel's root (`sandbox-tee::intel_pcs`), and
  the quote verifies through that PCK: the quote signature, the QE report's
  endorsement of the attestation key, and the PCK's signature over the QE
  report.
- Its `report_data` is the binding of this attestation's unit, receipt and
  outcome, and of the challenge issued. It is refused for any other
  challenge, and without one.
- An attestation whose outcome is changed is refused.
- Given another certificate in place of Intel's root, no anchor is derived.

## What it does not show

- The unit is a fixed placeholder. This exercises the binding, the chain
  check and the verifier on real hardware, not an executor's isolation of a
  workload.
- Revocation was not consulted: Intel publishes CRLs for the PCK CAs, and
  checking them is the deployment's step.
- The receipt and Supervisor keys are fixed development keys. The trust here
  rests on the quote, not on those signatures.