{"id":23734370,"url":"https://github.com/jesserc/sevsnp-tee","last_synced_at":"2025-06-27T13:36:38.770Z","repository":{"id":269090995,"uuid":"906395197","full_name":"Jesserc/sevsnp-tee","owner":"Jesserc","description":"On-Chain Verification for AMD SEV-SNP Trusted Execution Environment (TEE)","archived":false,"fork":false,"pushed_at":"2025-02-08T14:16:02.000Z","size":398,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-08T15:24:29.412Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Solidity","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Jesserc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-12-20T20:07:19.000Z","updated_at":"2025-02-08T14:16:06.000Z","dependencies_parsed_at":"2024-12-20T21:27:41.173Z","dependency_job_id":"75b9c212-2298-4c75-aca8-9a333a9edc06","html_url":"https://github.com/Jesserc/sevsnp-tee","commit_stats":null,"previous_names":["jesserc/sevsnp-cvm","jesserc/sevsnp-tee"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Jesserc%2Fsevsnp-tee","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Jesserc%2Fsevsnp-tee/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Jesserc%2Fsevsnp-tee/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Jesserc%2Fsevsnp-tee/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Jesserc","download_url":"https://codeload.github.com/Jesserc/sevsnp-tee/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239860688,"owners_count":19709084,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-31T05:45:30.650Z","updated_at":"2025-02-20T15:24:31.065Z","avatar_url":"https://github.com/Jesserc.png","language":"Solidity","funding_links":[],"categories":[],"sub_categories":[],"readme":"# TEE-Verified Price Feed Using Azure Confidential VMs\n\nThis project demonstrates how Trusted Execution Environments (TEEs) can be utilized. Here I create a secure and verifiable cryptocurrency price feed, by leveraging AMD SEV-SNP TEE technology with Azure cloud services. The key aspects include:\n\n1. **Secure Price Fetching**: Prices are fetched within an encrypted TEE, isolated from the host OS and hypervisor, including the cloud provider (Azure in this case).\n\n2. **Hardware Attestation**: Azure's attestation service verifies the TEE's integrity and signs a report containing the price data and VM security configuration.\n\n3. **Multi-Layer Verification**: The signed attestation report is verified both off-chain and on-chain.\n\n\n## Project Structure\n\n```\n/sevsnp-tee/\n├── SolRsaVerify/                 # Solidity verification contracts\n│   ├── src/\n│   │   ├── AzureTEEVerifier.sol  # Main attestation verification\n│   │   ├── RsaVerify.sol         # RSA signature validation\n│   ├── test/\n│   │   └── AzureTEEVerifier.t.sol # Integration tests with foundry's FFI\n├── main.py                       # Price fetching \u0026 attestation\n├── AttestationClient             # Azure TEE attestation binary  \n└── run.sh                        # Automation script\n```\n\n## Components\n![image](https://github.com/user-attachments/assets/ed855de2-e172-440c-a1bc-7b2a3bc917fc)\n\n### Price Attestation (main.py)\n- Fetches real-time cryptocurrency prices from CoinMarketCap's API using an authentication key\n- Executes a C++ Attestation Client binary (via a sub-process) which requests hardware-level attestation from the AMD SEV-SNP TEE and obtains a verified JWT token (of the attestation report) from Microsoft Azure Attestation service\n- Extracts and formats the JWT token's signature, message, security claims and price data into ABI-encoded parameters [enables smart contracts to verify the attestation on-chain]\n\n### Onchain Attestation Verification (AzureTEEVerifier.sol)\n- Verifies the cryptographic authenticity of attestation reports using RSA signature validation against Microsoft Azure Attestation's public key [proves report wasn't tampered with]  \n- Checks TEE security claims to ensure the environment is properly hardened - including debug mode status, AMD SEV-SNP configuration, and VM isolation level [confirms secure execution]\n- Stores verified price data with timestamps and enforces 15-minute freshness window for price validity [prevents use of stale data]\n\n### Integration Testing (AzureTEEVerifier.t.sol)  \n- Executes Python-based attestation script through Foundry's FFI to obtain real hardware attestations [tests full attestation flow]\n- ABI decodes attestation parameters and validates them through the onchain verification contract [ensures verification logic works]\n- Confirms both successful signature verification and correct storage of attested price data [validates core functionality]\n\n## Setup Requirements\n\n- Azure SEV-SNP VM with attestation support\n- Python 3.x with imported libraries (more details in the setup below)\n- Foundry toolkit for Solidity testing\n  \n## Installation\n\n1. **SSH Access Setup** (Required for VM access)\n```bash\n# Make private key read-only for SSH security\nchmod 400 \u003cpath/to/private/key\u003e.pem\n\n# Connect to VM\nssh -i \u003cpath/to/private/key\u003e.pem \u003cusername\u003e@\u003cvm-ip\u003e\n```\n\n2. **Project Setup** (Get source code and dependencies)\n```bash\n# Clone repository with submodules\ngit clone --recurse-submodules https://github.com/Jesserc/sevsnp-tee.git\ncd sevsnp-tee\n\n# Install system dependencies for C++ attestation client\nsudo apt-get update\nsudo apt-get install -y build-essential libcurl4-openssl-dev \\\n    libjsoncpp-dev libboost-all-dev cmake nlohmann-json3-dev\n```\n\n3. **Azure Attestation Setup** (For hardware attestation functionality)\n```bash\n# Download and install Azure guest attestation package\ncurl -O https://packages.microsoft.com/repos/azurecore/pool/main/a/azguestattestation1/azguestattestation1_1.0.5_amd64.deb\nsudo dpkg -i azguestattestation1_1.0.5_amd64.deb\n```\n\n4. **Attestation Client Build** (Compile C++ attestation code)\n```bash\n# Build the attestation client\ncd confidential-computing-cvm-guest-attestation/cvm-attestation-sample-app\ncmake .\nmake\n\n# Copy binary to project root\ncp AttestationClient ../../\ncd ../../\n```\n\n5. **Development Tools** (For testing and verification)\n```bash\n# Install Python dependencies\nsudo apt-get install -y python3-pip\npip3 install requests cryptography eth-abi\n\n# Install Foundry toolkit for Solidity\ncurl -L https://foundry.paradigm.xyz | bash\nsource ~/.bashrc\nfoundryup\n```\n\n6. **Final Setup** (Prepare for execution)\n```bash\n# Make run script executable\nchmod +x run.sh\n```\n\n## Usage\n\nRun the complete attestation \u0026 verification flow:\n```bash\n./run.sh\n```\n\nThis executes:\n1. Price fetching in TEE\n2. Attestation report generation\n3. On-chain verification\n4. Integration tests\n\n## Getting the Attestation Report  \nIf you want to view just the attestation report, you can run the built `AttestationClient` binary:  \n```shell\nsudo ./AttestationClient -o token\n```  \nYou should get a JWT token result, similar to what we have here: [Attestation_report_jwt.md](./Attestation_report_jwt.md).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjesserc%2Fsevsnp-tee","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjesserc%2Fsevsnp-tee","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjesserc%2Fsevsnp-tee/lists"}