Platform / Attestation

Cryptographic Attestation

Every execution produces a hardware-signed report proving the exact code version, measurement hash, and enclave configuration — verifiable by any relying party.

Attestation flow

Remote attestation in Almure follows the DCAP (Data Center Attestation Primitives) standard for Intel TDX and the equivalent SEV-SNP attestation protocol for AMD. The chain of trust is rooted in the CPU hardware itself:

At enclave initialisation, the CPU measures the workload and generates a platform-specific signing key pair scoped to the enclave's mrenclave value.
Almure's attestation service submits the quote to the hardware manufacturer's quote verification service (Intel PCS or AMD ASP) to obtain a signed verification certificate.
The resulting attestation report — containing mrenclave, mrsigner, isvsvn (security version number), and optionally a 64-byte report_data field you control — is returned to the caller alongside the workload result.
Any relying party (your compliance team, an auditor, a downstream service) can independently verify the report against the public hardware root of trust.

Attestation flow diagram

Sample DCAP attestation report

The following illustrates the key fields in an Almure attestation report header:

attestation-report.json

{
  "mrenclave":  "3a8f2c1d9e4b7a06f5d38c12e91b4a7f2e8d6c4b1a9e3f7d2c5b8a4e6f1d9c2b",
  "mrsigner":   "c7e4b2f1a8d3906e5c2b4f9a1e7d3c8b2a5f4e9c1d6b3a7f8e2d5c4b9a1f7e3",
  "isvsvn":     3,
  "isvprodid":  1,
  "report_data": "7f3a9c2e1b5d8f4a6e2c9b7d3a5f1e8c4b9a2d6f3e7c1b5a8d4f2e9c6b3a7f1",
  "timestamp":  "2025-11-14T09:47:22Z",
  "enclave_id": "enc_7k3mxp92qz"
}

Attestation records in your audit log

Almure maps each attestation report to a structured audit log entry that your compliance team can query. Every entry contains the workload identifier, execution timestamp, measurement hash, policy version that was enforced, and the result disposition (encrypted output delivered / execution aborted due to policy violation). This creates a continuous, hardware-grounded audit trail without requiring manual log entry by operators.

For Japanese financial institution compliance reviews under FISC guidelines, this log provides the execution evidence trail that demonstrates data was processed inside a boundary with specific technical controls — without revealing the actual data contents.