Adding arbitary data to sev-snp attestation report

[pegahnikbakht]

Hi,

In SEV-SNP how we can add arbitrary data to attestation report file using vTPM NVRAM?
I'm using the following commands to extract the report from an azure VM:

 % tpm2_nvread -C o 0x01400001 > ./snp_report.bin
% dd skip=32 bs=1 count=1184 if=./snp_report.bin of=./guest_report.bin

[nicopal]

Hi, this is relevant for us as well. Is there any update on this?

[jepio]

The way to do this in an SNP CVM is by including the arbitrary data in a TPM quote via "nonce" parameter, the TPM quote signing key is included in the SNP report. Follow the process here: #18 (comment).

The SNP report is only generated once during boot and is used to attest the key in the TPM. In this architecture, allowing users to attest arbitrary data through the SNP report would allow spoofing the report for an arbitrary non-TPM key and bypass the whole security architecture. So this is not possible.