GPUCC-BIND-01: The GPU attestation is cryptographically bound to the CVM¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | NVIDIA GPU Confidential Computing |
| Lifecycle stage | attest |
| Policy | P-03: Key release requires an attested measurement |
| Trust boundary | cvm |
| Assurance | report-derived |
| Mode | Passive: reads only the files and values you pass to the scan. |
What a failure enables¶
- Model inputs and weights readable by the host
- Workload trusted on a CPU context nobody verified
What it checks¶
It passes when:
- The GPU attestation and the CVM quote are cryptographically bound.
How to fix¶
- Bind the two TEEs: include the CVM measurement (MRTD/RTMR) in the GPU attestation challenge/nonce and the GPU identity in the CVM quote, and verify BOTH together. An unbound GPU report is relayable onto any CVM — verifying the GPU TEE alone is necessary but not sufficient.
- Bind the GPU report to the CVM measurement and verify both together; an unbound GPU report is relayable onto any CVM.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No --gpu-attestation-report specified; skipping check.
ERROR:
- Could not read/parse attestation report: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--gpu-attestation-report |
Path to a captured NVIDIA GPU attestation report (JSON). |
Permissions¶
None. The check reads only the files or values you pass to the scan.
Related¶
- Runtime detection
DET-G2(NVIDIA GPU CC): A different GPU is behind the deployment - Other checks for policy P-03: CSPACE-KEYBIND-01, CSPACE-KEYBIND-03, CSPACE-KMS-01, CSPACE-KMS-02, GPUCC-DECRYPT-01, GPUCC-KEY-01, HSM-01, KBS-01, KMS-01, VAULT-01
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).