Attestation Result Verification#

Functions#

nvat_rc_t nvat_verify_attestation_result(const char *eat, const char *nras_base_url, const char *service_key, nvat_nonce_t expected_nonce, nvat_http_options_t http_options, const nvat_jwt_validation_options_t jwt_validation_options, nvat_claims_collection_t *out_claims)

Verify an NVIDIA attestation token (detached EAT) issued by NRAS.

nvat_rc_t nvat_verify_ear(const char *ear_jwt, const char *verifier_base_url, const char *service_key, nvat_nonce_t expected_nonce, nvat_http_options_t http_options, nvat_jwt_validation_options_t jwt_validation_options, nvat_str_t *out_ear_json)

Authenticate a signed Entity Attestation Result (EAR).

Functions#

nvat_rc_t nvat_verify_attestation_result(
const char *eat,
const char *nras_base_url,
const char *service_key,
nvat_nonce_t expected_nonce,
nvat_http_options_t http_options,
const nvat_jwt_validation_options_t jwt_validation_options,
nvat_claims_collection_t *out_claims,
)#

Verify an NVIDIA attestation token (detached EAT) issued by NRAS.

Intended for a relying party that receives an EAT out of band and wants to verify it without re-running attestation. Fetches NRAS’s published public keys from nras_base_url/.well-known/jwks.json, verifies the ES384 signature of the overall and per-device submodule JWTs, validates the submodule digests, and returns the verified claims.

Apply a relying party policy to the result with nvat_apply_relying_party_policy. See nvat_claims_collection_st for the claims format.

Note

The token must always contain an eat_nonce. If expected_nonce is provided, the token’s eat_nonce must equal it for freshness; otherwise the nonce value is not checked against any expected value.

Parameters:

  • eat – NULL-terminated detached-EAT JSON string to verify.

  • nras_base_url – Base URL of the NRAS instance that issued the token (e.g. “https://nras.attestation.nvidia.com”). The JWKS path is appended internally. Must not be NULL.

  • service_key – Optional service key sent with the JWKS fetch. The public NRAS JWKS endpoint does not require one; pass NULL to send no credential. Provided for consistency with the other remote calls and for deployments that authenticate the JWKS fetch.

  • expected_nonce – Optional nonce the relying party expects the token to be bound to. When non-NULL, the token’s overall eat_nonce must equal it or verification fails with NVAT_RC_NONCE_MISMATCH. Pass NULL to skip the nonce comparison. Not consumed; caller retains ownership.

  • http_options – Optional HTTP/TLS options (CA roots, timeouts). Pass NULL for defaults.

  • jwt_validation_options – Optional JWT time-claim validation settings. Pass NULL for the default 60-second clock-skew leeway.

  • out_claims – Out parameter; on success points to a newly allocated claims collection. Caller owns it; free with nvat_claims_collection_free().

Returns:

NVAT_RC_OK on success; NVAT_RC_OVERALL_RESULT_FALSE if the token’s overall attestation result is false (with out_claims still set); NVAT_RC_NONCE_MISMATCH if expected_nonce was supplied and does not match the token’s eat_nonce; NVAT_RC_NRAS_TOKEN_INVALID if the signature, issuer, or structure is invalid; NVAT_RC_BAD_ARGUMENT for NULL required arguments; other codes for HTTP/JWKS errors.

nvat_rc_t nvat_verify_ear(
const char *ear_jwt,
const char *verifier_base_url,
const char *service_key,
nvat_nonce_t expected_nonce,
nvat_http_options_t http_options,
nvat_jwt_validation_options_t jwt_validation_options,
nvat_str_t *out_ear_json,
)#

Authenticate a signed Entity Attestation Result (EAR).

The SDK fetches the verifier’s well-known JWKS, verifies the ES384 signature and issuer, and returns authenticated EAR JSON only on success. It does not validate the EAR schema or appraisal semantics; callers can apply those requirements through relying-party policy.

Note

The iat, nbf, and exp claims are validated when present but are not required. A token without exp has no token-defined expiration.

Parameters:

  • ear_jwt – Non-empty compact EAR JWT to verify.

  • verifier_base_url – Non-empty HTTPS base URL for the verifier.

  • service_key – Optional service key for the JWKS request. It is sent only to HTTPS nvidia.com hosts and subdomains; otherwise it is suppressed.

  • expected_nonce – Optional expected nonce. When provided, the token must contain a matching canonical eat_nonce; otherwise the nonce claim is not inspected. The caller retains ownership.

  • http_options – Optional HTTP/TLS settings. Pass NULL for defaults.

  • jwt_validation_options – Optional JWT validation settings. Pass NULL for the default 60-second clock-skew leeway.

  • out_ear_json – Required output parameter. It is set to NULL before validation and remains NULL on every failure. On success it receives a newly allocated authenticated EAR JSON string; free it with nvat_str_free.