📖Glossary
Useful notions related to SecretVM
Last updated
Was this helpful?
Useful notions related to SecretVM
Last updated
Was this helpful?
Was this helpful?
A cryptographically signed data structure that serves as evidence during the attestation process. It contains measurements and metadata collected from the Trusted Execution Environment (TEE) that can be verified by external parties.
Generated by trusted hardware (e.g., Intel's Quoting Enclave in TDX).
Tamper-proof and verifiable using Intel’s public keys.
Includes the Attestation Report, as well as signing certificates.
A structured document derived from the Attestation Quote. It contains key cryptographic measurements and signatures that prove the integrity of a system’s boot process.
Key fields include:
MRTD (Measurement Register for Trust Domain) — Hash of the firmware measured by SEAM.
RTMR0 — Measurements of configuration elements such as CFV, TDHOB, and ACPI tables.
RTMR1 — Hash of the operating system kernel.
RTMR2 — Measurement of the kernel command line and initramfs.
RTMR3 — Hash of the root file system and docker-compose.yaml.
A cryptographic hash of a specific component (e.g., firmware, kernel, configuration). These measurements are extended into secure registers (MRTD, RTMR0–3) and form the basis of attestation by proving no tampering has occurred.
Supporting information required to verify the authenticity of an Attestation Quote. This includes:
Intel signing certificates and public keys
TCB (Trusted Computing Base) metadata
Quoting Enclave (QE) identity
Certificate Revocation Lists (CRLs)
Quote verification metadata
Collateral is critical to validating that:
The quote was produced by genuine Intel hardware
Platform components are at appropriate security patch levels
None of the components have been revoked or compromised
This forms the external trust chain that links attestation results to Intel as the root of trust.
A hardware-based Confidential Computing technology by Intel that enables the creation of confidential virtual machines. TDX isolates guest VMs from the host and hypervisor, offering enhanced data privacy and integrity.
An open-source hardware virtualization and emulation platform. It can:
Emulate one architecture on another (e.g., ARM on x86).
Virtualize workloads at near-native speed using KVM.
Support TDX features to run confidential virtual machines with Intel's security guarantees.
A privileged, hardware-enforced environment in the Intel TDX architecture. The SEAM module runs in this mode and provides the core trust anchor for confidential VMs.
Key responsibilities:
Manages the lifecycle of Trust Domains (TDs)
Enforces memory isolation between VMs and host
Performs cryptographic operations and quote generation
Mediates between the untrusted hypervisor and secure VMs
Applies security policies for TDX-protected environments
The integrity of SEAM is critical to the TDX security model, and its measurement (MRSEAM) is included in the attestation report.