Attestation

Verify the Phala gateway’s TDX evidence, nonce-bound keyset, expiry, and measured compose.

The attestation report describes the Phala gateway, rather than every upstream model’s execution environment. It publishes the gateway’s receipt-signing, TLS, and E2EE keys. Upstream evidence is in the attested session cited by a response receipt, and its coverage varies by provider.

​

Inspect the report

The endpoint is public. Generate a fresh 32-byte nonce, encoded as exactly 64 lowercase hex characters:

NONCE=$(openssl rand -hex 32)
curl --fail-with-body -sS "https://inference.phala.com/v1/aci/attestation?nonce=$NONCE" \
  -o report.json

jq '{api_version, workload_keyset_digest,
     report_data: .attestation.report_data,
     not_after: .attestation.workload_keyset.not_after,
     provenance: .attestation.source_provenance}' report.json

These commands inspect the document. They do not verify a hardware quote, the nonce binding, or a receipt signature. Applications should use connectAci(); agent tools can use Private AI Proxy.

​

Report fields

Field	Meaning
api_version	aci/1.
workload_keyset_digest	sha256: digest of the RFC 8785 JCS form of the complete published keyset.
attestation.tee_type	TEE technology, currently tdx for this gateway.
attestation.workload_keyset	subject, not_after, receipt_signing_keys, e2ee_public_keys, and tls_public_keys.
attestation.report_data	Digest of the nonce/keyset statement bound into the quote.
attestation.evidence	Quote, report data, boot event log, VM configuration, app_compose, key custody, and downstream TLS binding.
attestation.source_provenance	Workload-declared source/build labels; these are not a trust root.
service_capabilities	Supported E2EE extension versions and serving: "aggregator".

The published receipt key uses algo: "ed25519" and key_id: "dstack-kms-receipt-ed25519-v1". Select the key from the verified report rather than hardcoding its public key.

​

Verification procedure

1. Verify the TDX quote. Verify attestation.evidence.quote against Intel DCAP collateral, inspect TCB status, and apply your OS and key-custody policy. A local verifier such as dcap-qvl can verify Intel evidence. The ACI SDK verifies the quote but does not check whether the dstack OS image is production or development. For OS-image assurance, verify the same quote, event log, and VM configuration with an independent dstack verifier and require is_valid: true.

2. Recompute the keyset digest. Canonicalize the complete attestation.workload_keyset with JCS (RFC 8785), hash those bytes with SHA-256, prefix the lowercase hex digest with sha256:, and require equality with workload_keyset_digest. Sorting keys with jq is not a general JCS implementation.

3. Check nonce binding. Build this exact statement with the recomputed digest and your nonce, without whitespace and in this field order:

   {"keyset_digest":"sha256:<hex>","nonce":"<64 lowercase hex>","purpose":"aci.report_data.v1"}
   

   Require its SHA-256 digest to equal attestation.report_data and the quote’s first 32 report-data bytes, with the remaining 32 bytes zero. A report fetched without a nonce does not establish freshness.

4. Check expiry. Require attestation.workload_keyset.not_after to be a future Unix timestamp under your policy. Reject implausibly distant expiry. Receipts must cite this verified workload_keyset_digest and a receipt key in this keyset.

5. Replay measured evidence. Replay the boot event log to the quote’s RTMR3. Confirm the measured compose-hash equals sha256(app_compose). Inspect the measured launcher/configuration path that selects the gateway release.

6. Apply release policy. For reviewed-release enforcement, compare the measured compose hash against an independently obtained, authenticated allowlist. source_provenance.repo_url and repo_commit are inspection labels; trusting them without measured corroboration does not establish a reviewed release. Pair compose appraisal with the independent OS verification in step 1.

7. Bind the client channel before sending traffic. Pin hostname-validated TLS to the SPKI listed for inference.phala.com in the attested keyset. The TypeScript SDK and Private AI Proxy implement this step.

A valid hardware quote alone does not verify a particular response. Continue with Verify a Response.

​

Legacy compatibility

GET /v1/attestation/report?nonce=… returns the gateway report with compatibility signer fields. signing_algo=ecdsa (default) or ed25519 selects the legacy signer. New integrations should use /v1/aci/attestation and the keyset directly.