TrustMee: Self-Verifying Remote Attestation Evidence
2026-02-13 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors address the challenge of verifying the security status of confidential virtual machines (cVMs), which usually needs special hardware knowledge. They propose a new method where the verification logic itself travels with the security proof inside a WebAssembly component, signed by a trusted source. This allows any verifier to check the signature and run the logic without needing to understand specific hardware details. They built a system called TrustMee to demonstrate this idea, working with AMD and Intel attestation technologies and outputting results in a common format.
remote attestationconfidential virtual machineshardware securityWebAssemblycode signingAMD SEV-SNPIntel TDXTrustee frameworkattestation evidenceEAT Attestation Result (EAR)
Authors
Parsa Sadri Sinaki, Zainab Ahmad, Wentao Xie, Merlijn Sebrechts, Jimmy Kjällman, Lachlan J. Gunn
Abstract
Hardware-secured remote attestation is essential to establishing trust in the integrity of confidential virtual machines (cVMs), but is difficult to use in practice because verifying attestation evidence requires the use of hardware-specific cryptographic logic. This increases both maintenance costs and the verifiers' trusted computing base. We introduce the concept of self-verifying remote attestation evidence. Each attestation bundle includes verification logic as a WebAssembly component signed by a trusted party. This approach transforms evidence verification into a standard code-signing problem: the verifier checks the signature on the embedded logic and then executes it to validate the evidence. As a result, verifiers can validate attestation evidence without any platform-specific knowledge. We implement this concept as TrustMee, a platform-agnostic verification driver for the Trustee framework. We demonstrate its functionality with self-verifying evidence for AMD SEV-SNP and Intel TDX attestations, producing attestation claims in the standard EAT Attestation Result (EAR) format.