TDX CVM attestation and provenance

1. Overview

Confidential Virtual Machines (CVMs) are a type of Compute Engine virtual machines that use hardware-based memory encryption and integrity protection. This helps ensure your data and applications can't be read or modified in memory while in use. In this codelab, you will learn how to generate an Intel TDX attestation quote on the CVM, and verify it locally for demonstration purposes. Additionally, you will verify the CVM's Google Cloud host and instance provenance.

This codelab includes the following steps:

• Setting up an Intel TDX Confidential VM
• Fetching a TDX Attestation Quote
• Verifying the TDX Attestation Quote and Nonce
• Verifying GCE Firmware (OVMF) Integrity
• Verifying GCE TDX Host and Instance Provenance

What you'll learn

• How to fetch a TDX Attestation Quote on a CVM using the go-tdx-guest tools
• How to verify the quote's authenticity, freshness (nonce), and GCE firmware integrity (OVMF)
• How to verify Google Cloud Host and Instance Provenance (PPID registry lookup and PZID instance binding)

What you'll need

• A Google Cloud Platform Project
• Basic knowledge of Google Compute Engine and Confidential VM

2. Setup and Requirements

To enable the necessary APIs, run the following command in the Google Cloud Console or your local development environment:

gcloud auth login

gcloud services enable \
    cloudapis.googleapis.com \
    cloudshell.googleapis.com \
    confidentialcomputing.googleapis.com \
    compute.googleapis.com

3. Setting up CVM and Fetching TDX Quote

In this step, you will create a TDX CVM and fetch a TDX attestation quote from the hardware.

1. Go to the Google Cloud Console or your local development environment. Create a CVM as follows:

gcloud config set project <project-id>

gcloud compute instances create tdx-cvm-attestation-codelab \
    --machine-type=c3-standard-4 \
    --zone=us-central1-c \
    --confidential-compute-type=TDX \
    --maintenance-policy=TERMINATE \
    --image-family=ubuntu-2204-lts \
    --image-project=ubuntu-os-cloud \
    --scopes https://www.googleapis.com/auth/cloud-platform

Replace <project-id> with the unique identifier of your project.

2. Connect to the CVM.

gcloud compute ssh --zone us-central1-c tdx-cvm-attestation-codelab

3. Set up a Go environment on the CVM:

wget https://go.dev/dl/go1.24.0.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.24.0.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin

4. Install the go-tdx-guest tools.

Clone the repository and build the attest tool, which generates a TDX quote.

git clone https://github.com/google/go-tdx-guest.git
cd go-tdx-guest/tools/attest
go build

Note: For some Ubuntu images, you may need to install and load the tdx_guest module if it's not loaded by default.

sudo apt-get update && sudo apt-get install -y linux-modules-extra-$(uname -r)
sudo modprobe tdx_guest

5. Fetch the TDX Attestation Quote:

Use the attest tool to generate a quote. We will pass a nonce (64 bytes of REPORT_DATA) and save the output to quote.bin.

nonce=$(head -c 64 /dev/urandom | xxd -p | tr -d '\n' | head -c 128)
sudo ./attest -in $nonce -inform hex -outform bin -out quote.bin

The TDX quote is now saved in quote.bin!

4. Verifying the TDX Attestation Quote

Now that we have generated an Intel TDX quote (quote.bin), we can verify it using the check tool provided in the go-tdx-guest repository. This tool checks the quote against Intel's specifications, verifies it against collateral downloaded from Intel's Provisioning Certification Service (PCS), and validates policy constraints like the nonce to prevent replay attacks.

1. Navigate to the check tool directory and build it:

cd ~/go-tdx-guest/tools/check
go build

2. Run the tool to verify both the cryptographic signatures and the nonce. We will use the -get_collateral=true flag to download the necessary TEE certificates from Intel's PCS, the -check_crl=true flag to verify certificate revocations, and the -report_data flag to validate the freshness of the nonce:

./check -in ~/go-tdx-guest/tools/attest/quote.bin -inform bin \
    -get_collateral=true -check_crl=true \
    -report_data $nonce

If the quote is cryptographically valid and the nonce matches, the tool will log a success message similar to the following example and exit with code 0:

INFO : TDX Quote verified successfully

Try a failure case: If you pass an incorrect nonce (e.g., running the command with -report_data 0000), the tool will fail with a validation error and output a detailed error showing the mismatch:

FATAL: error validating the TDX Quote: quote field REPORT_DATA is 637b8dd7c133... Expect 0000...

5. Verifying GCE Firmware (OVMF) Integrity

While Intel's collateral verifies the hardware, it does not verify that the virtual machine is running a genuine, unmodified Google Compute Engine (GCE) firmware.

Google publishes signed Launch Endorsements (containing golden Reference Integrity Measurements, or RIMs) for all official GCE UEFI (OVMF) firmware releases to a public Google Cloud Storage (GCS) bucket.

In this step, we will use Google's public gce-tcb-verifier tool to automatically fetch the firmware endorsement from GCS, verify Google's signature on it, and validate our CVM's firmware measurement (MRTD) against it.

1. Build the GCE TCB Verifier Tool

1. Clone the public gce-tcb-verifier repository from GitHub:

cd ~
git clone https://github.com/google/gce-tcb-verifier.git

2. Navigate to the CLI tool directory and build it:

cd gce-tcb-verifier/gcetcbendorsement/cli
go build -o gcetcbendorsement

3. Add the built tool to your PATH for convenience:

export PATH=$PATH:$(pwd)

2. Validate the Quote against GCE Firmware Endorsement

Now, run the gcetcbendorsement tool to validate your attestation quote. Because the tool succeeds silently upon a successful verification, we can chain the command with && echo "Validation Succeeded!" to get a friendly and explicit confirmation of success:

gcetcbendorsement tdx validate ~/go-tdx-guest/tools/attest/quote.bin && echo "Validation Succeeded!"

Output:

Validation Succeeded!

What is happening under the hood?

1. Extraction: The tool parses quote.bin and extracts the firmware measurement (MRTD) from the TD Quote Body.
2. Fetching: It constructs a GCS URL using the MRTD and downloads the corresponding VMLaunchEndorsement from Google's public bucket (gs://gce_tcb_integrity).
3. Signature Verification: It fetches Google's public Root CA certificate (https://pki.goog/cloud_integrity/GCE-cc-tcb-root_1.crt) and cryptographically verifies Google's signature on the downloaded endorsement.
4. Measurement Validation: It compares the MRTD signed by the TDX hardware in your quote against the golden reference measurements in Google's signed endorsement.

If all checks pass, the command will exit with code 0 silently (or print Validation Succeeded! with the chained echo), proving your VM is running genuine Google-endorsed firmware!

6. Verifying GCE TDX Host and Instance Provenance

While attestation and firmware verification confirm that your VM is running on genuine Intel TDX hardware with Google-endorsed UEFI firmware, GCE TDX Provenance Verification connects your attestation quote directly to Google Cloud's infrastructure in two critical ways:

1. Host Provenance: Identifies the physical Google Cloud host machine running your VM by extracting the platform's unique PPID (Platform Provisioning ID) from the quote's PCK certificate. It then retrieves the host platform's registry record from Google Cloud Storage (confidential-host-registry), which records the physical zone and when Google Cloud last provisioned the host's attestation certificates.
2. Instance Provenance (PZID Binding): Google Cloud cryptographically binds your specific VM's identity (ProjectNumber, Zone, and InstanceID) into the TDX quote's MR_OWNER register. Verifying this binding ensures that the quote belongs exclusively to your instance and prevents quote replay or substitution attacks across different VMs or projects.

The gceprovenance CLI tool (also located in the go-tdx-guest repository) automates full provenance verification—checking quote authenticity, freshness challenge, host registry record, and instance PZID binding in one command.

1. Navigate to the gceprovenance directory and build the tool:

cd ~/go-tdx-guest/tools/gceprovenance
go build

2. Run full provenance verification using the verify command. We will pass the quote file (quote.bin) and the nonce challenge ($nonce) we generated earlier:

./gceprovenance verify -quote ~/go-tdx-guest/tools/attest/quote.bin -challenge $nonce

Note: You can also run full provenance verification directly on the VM without passing -quote by executing sudo ./gceprovenance verify. The tool will automatically fetch a fresh attestation quote from the hardware!

3. When all checks succeed, the tool outputs a verification report similar to the following:

GCE TDX provenance verification: OK

Instance: projects/123456789012/zones/us-central1-c/instances/987654321098765

Checks
  Quote verification: OK
  REPORT_DATA challenge: OK
  Host registry document: found
  PZID binding: OK

PPID: 0123456789abcdef0123456789abcdef
Quote: tdx_quote.bin
Host registry: host_registry.json

What is happening under the hood?

• Quote & Challenge: The tool verifies the quote's signature chain against Intel's root certificate and confirms that the quote's REPORT_DATA matches your $nonce challenge.
• Host Provenance (PPID): It extracts the 32-character hex PPID from the leaf PCK certificate and downloads the host registry JSON document from GCS (https://storage.googleapis.com/confidential-host-registry/).
• Instance Provenance (PZID): It queries the local GCE Metadata Server for your instance's numeric project ID, zone, and instance ID, constructs the canonical PZID JSON payload ({"instanceId":...,"numericalProjectId":...,"zone":...}), computes its SHA-384 digest, and verifies that it matches MR_OWNER in the quote.

4. Inspect the retrieved Host Registry document:

By default, the verify command saves the fetched host registry JSON document to host_registry.json. You can inspect it to view the host platform's metadata:

cat host_registry.json

Example output:

{
  "zone": "us-central1",
  "timestamp": "2026-02-17T11:25:12Z"
}

This metadata describes the host machine properties:

• zone: The physical Google Cloud region/zone where the host machine resides.
• timestamp: The UTC date and time when this host machine's hardware attestation certificates were last provisioned and verified by Google Cloud.

7. Cleanup

Run the following commands in cloud console or your local development environment:

# Delete the CVM instance
gcloud compute instances delete tdx-cvm-attestation-codelab --zone=us-central1-c

8. What's next

Learn more about Confidential VMs and Compute Engine.