The Problem: Trusting a Remote Node
In a Zero Trust architecture, a sensitive API server should not grant access to a worker node simply because it presents a valid TLS certificate or has the right IP address. Certificates can be stolen. IPs can be spoofed. What the server really needs to know is: "Is this worker node running the official, uncompromised kernel and configuration that I expect?"
This is the problem Remote Attestation solves. It allows one machine to cryptographically prove to another machine that its software stack is in a specific, verified state — without the verifier having to physically inspect the machine.
The Attestation Flow
Worker Node Attestation Server
│ │
│ ←──── 1. Challenge (nonce) ──────────│
│ │
│ [Worker asks TPM to generate Quote] │
│ TPM signs PCR values + nonce │
│ using Attestation Key (AK) │
│ │
│ ──── 2. Quote (signed PCRs) ────────→│
│ │
│ [Server verifies:] │
│ - AK signature is valid │
│ (proves real TPM) │
│ - Nonce matches │
│ (prevents replay) │
│ - PCR values match │
│ known-good policy │
│ │
│ ←──── 3. Access Token ──────────────│
│ │
Key terms:
- Nonce: A random number used once. Including it in the Quote prevents an attacker from replaying a previously captured valid Quote.
- Attestation Key (AK): A signing key generated inside the TPM. Its public key is certified by the TPM manufacturer (via the Endorsement Key), proving it belongs to a real, unmodified TPM chip.
- Endorsement Key (EK): A key burned into the TPM at manufacture time. It proves the TPM is genuine hardware, not a software emulator. The EK certificate is signed by the TPM manufacturer (e.g., Infineon, STMicroelectronics).
- Quote: A TPM-signed statement containing the current PCR values and the nonce.
Real-World Implementations
Google Confidential Computing uses TPM-based attestation to verify that a VM is running inside a genuine AMD SEV-SNP or Intel TDX enclave before releasing customer encryption keys.
Keylime is an open-source remote attestation framework for Linux that continuously monitors PCR values and IMA logs on a fleet of machines, alerting when any node's state deviates from policy.
AWS Nitro Attestation uses a similar mechanism: EC2 instances can request a signed attestation document from the Nitro hypervisor, which a KMS server verifies before releasing encryption keys.
Concretely, with tpm2-tools, the prover generates a signed quote over a chosen PCR set and the verifier's nonce, and the verifier checks that quote against the expected public attestation key, the nonce it sent, and the expected PCR values — the same three checks described above, just expressed as two CLI calls (tpm2_quote on the prover, tpm2_checkquote on the verifier).
A common interview question: "Why does remote attestation include a nonce?" The answer has two parts. First, it prevents replay attacks — without a nonce, an attacker could capture a valid Quote from a healthy machine and replay it later when the machine is compromised. Second, it proves freshness — the Quote was generated right now, in response to this specific challenge, not pre-computed. Follow-up: "What prevents the TPM manufacturer from being a single point of trust?" Answer: attestation services typically maintain a database of known-good EK certificates from multiple manufacturers and can cross-validate against the TCG's certificate authority.
Key Point: Remote attestation shifts trust from network identity (IP, certificate) to hardware-verified software state. A node cannot lie about its PCR values because the Quote is signed by a key that never leaves the TPM silicon. This is the foundation of confidential computing and hardware-rooted Zero Trust.