Attestation
Verify what booted on a node before you send it data or keys.
All steps
Before a node is assigned, its drives are cryptographically erased and its firmware is re-flashed from images signed by the vendor.
- Signed by
- Vendor firmware signatures
- Fails closed
- A node whose firmware does not verify is pulled from the pool.
Each boot stage measures the next into the node's TPM before running it: firmware, bootloader, kernel and initial filesystem.
- Signed by
- TPM endorsement key
- Fails closed
- Measurements cannot be removed after the fact; a changed stage changes the record.
The driver switches supported GPUs into confidential-computing mode, encrypting the path between CPU and GPU, and asks each GPU for a signed report.
- Signed by
- GPU device certificate, chained to the vendor
- Fails closed
- A GPU that cannot enter confidential mode is reported as such; your policy decides.
Each GPU returns a report of its firmware and mode, signed by a key fused into the device.
- Signed by
- GPU device key
- Fails closed
- A missing or unsigned report is evidence of nothing, and fails verification.
The node bundles the TPM quote and GPU reports and sends them to your verifier. We relay the evidence; we cannot forge it.
- Signed by
- Hardware keys only — not ours
- Fails closed
- Stale evidence is rejected by a nonce you supply.
Your verifier compares the measurements with your policy and the vendors' published reference values.
- Signed by
- Your policy
- Fails closed
- Any mismatch stops the sequence. The node runs, but receives nothing.
Only after verification does your key service release the key that unlocks your disks and weights — wrapped to that node.
- Signed by
- Your key service
- Fails closed
- Keys never pass through our control plane in usable form.
Attestation lets you check, cryptographically, what firmware and software a node booted and whether its GPUs are in confidential-computing mode. You verify the evidence yourself; you do not have to take our word for it.
What is measured
On every boot of a node with confidential mode enabled, the following are measured and recorded before the node is marked ready:
| Measurement | Source |
|---|---|
| Host firmware and option ROMs | TPM platform configuration registers |
| Bootloader, kernel and initrd | TPM, extended during boot |
| Your image signature | Recorded by the bootloader |
| GPU firmware and confidential-computing mode | GPU attestation report, signed by the GPU |
Getting the evidence
cloister attest get node_7Hq2 --out evidence.json
The evidence bundle contains the TPM quote, the event log, each GPU’s signed report and the certificate chains needed to check them. A fresh nonce you supply is included in the quote, so old evidence cannot be replayed:
cloister attest get node_7Hq2 --nonce $(openssl rand -hex 32)
Writing a policy
A policy states what you are willing to accept. The CLI evaluates policies written in Rego:
package cloister.attest
default allow := false
allow if {
input.gpu.cc_mode == "on"
input.gpu.firmware_version in data.approved_gpu_firmware
input.boot.image_signer == "acme-release-key"
input.boot.secure_boot == true
}
cloister attest verify node_7Hq2 --policy ./policy.rego
Releasing keys
The point of attestation is to make key release conditional. A typical flow:
- The node starts and requests its volume key from your key service.
- Your key service fetches fresh evidence for that node.
- It evaluates your policy and returns the key only if the policy allows it.
If verification fails, the node stays running without your data. You can inspect the event log to see which measurement differed.
What attestation does not cover
Attestation proves what booted. It does not prove that your own software is free of vulnerabilities, and it does not cover workloads on accelerators without hardware confidential-computing support. The GPU catalog lists which accelerators support it.