Linux Security Summit Europe 2022

In a confidential compute environment, the untrusted hypervisor controls the configuration of the platform and the launch of the secure guest. Guests VMs that run in the confidential compute environment constructed by AMD SEV Secure Nested Paging (AMD SEV-SNP) can retrieve a signed document, called an attestation report, that contains measurements and configuration information of both the platform and the guest. Relying parties can use the attestation report to establish trust with the guest before granting access to secrets and sensitive resources to a guest. This talk will explain how attestation works in SEV-SNP, how attestation reports can be securely verified, and how attestation can fit into the Linux guest boot flow.