Skip to content

GPUCC-SIGVERIFY-01: The attestation report signature is cryptographically verified

Property Value
Severity critical
Platform NVIDIA GPU Confidential Computing
Lifecycle stage attest
Trust boundary attestation
Assurance operator-declared
Mode Passive: reads only the files and values you pass to the scan.

What a failure enables

  • Model keys released on a fabricated or replayed report

How to fix

  • Cryptographically verify the attestation report signature against the GPU device key (and chain it to the NVIDIA RoT) before trusting any claim in it — never parse-and-trust. Capture with nvattest attest --verifier remote and retain the NRAS JWKS as nras-jwks.json beside the report, so the result is NVIDIA-signed.

After the fix, scan again: the check should report PASS.

When it is not assessed

SKIP:

  • No --gpu-verifier-policy specified; skipping check.

ERROR:

  • Could not read/parse verifier policy: …
  • Could not read/parse attestation report: …

Scan inputs

The untrust scan options this check reads:

Option Description
--gpu-attestation-report Path to a captured NVIDIA GPU attestation report (JSON).
--gpu-verifier-policy Verifier policy JSON: pinned RIM measurements, cert chain, revocation.

Permissions

None. The check reads only the files or values you pass to the scan.

  • Runtime detection DET-G4 (NVIDIA GPU CC): Attestation result replayed

Generated from untrust 1.3.0 (commit 7ef462d9a0c3).