intel / intel/confidential-computing.tee.dcap.qvl
Error verifying bundled TDX sample data: STATUS_TDX_MODULE_MISMATCH(85)
- Dominant language
- C++
- Stars
- 15
- Forks
- 12
- PR merge metrics
- No merged PRs in 30d
Description
When I try to verify the bundled TD Quote sample using the `AttestationApp` tool, it fails with a `STATUS_TDX_MODULE_MISMATCH(85)` error. In contrast, verifying the bundled SGX Quote sample with the same tool succeeds without any issues. This suggests the problem is specific to the TDX verification path.
## To Reproduce
### Version Info
- SGX-TDX-QVL: v1.1.8886
- CMake: 3.22.1
- clang: 14.0.0-1ubuntu1.1 \[x86_64-pc-linux-gnu\]
### Build
To get detailed error logs, we build QVL with the `-DBUILD_LOGS=1` flag. This flag does not affect the bug reported.
```bash
sudo apt update
sudo apt install -y cmake clang
git clone https://github.com/intel/SGX-TDX-DCAP-QuoteVerificationLibrary
cd ./SGX-TDX-DCAP-QuoteVerificationLibrary/Src
./release -DBUILD_LOGS=1
export LD_LIBRARY_PATH=$PWD/Build/Release/dist/include:$LD_LIBRARY_PATH
export LD_LIBRARY_PATH=$PWD/Build/Release/dist/lib:$LD_LIBRARY_PATH
```
### Verification
```bash
cd ./Build/Release/dist/bin
./AttestationApp \
--quote sampleData/tdx/quote.dat \
--pckCert sampleData/tdx/pckCert.pem \
--pckSignChain sampleData/tdx/pckSignChain.pem \
--rootCaCrl sampleData/tdx/rootCaCrl.der \
--intermediateCaCrl sampleData/tdx/intermediateCaCrl.der \
--trustedRootCaCert sampleData/tdx/trustedRootCaCert.pem \
--tcbInfo sampleData/tdx/tcbInfo.json \
--tcbSignChain sampleData/tdx/tcbSignChain.pem
```
```plaintext
[2025-08-04T02:47:34.195Z] [INFO] [AttestationApp ...PATH.../SGX-TDX-DCAP-QuoteVerificationLibrary/Src/AttestationCommons/src/Utils/Logger.cpp:101] [pid:34834] QVL Logging enabled and configured
Running QVL version: 1.0.0
[2025-08-04T02:47:34.201Z] [ERROR] [AttestationApp ...PATH.../SGX-TDX-DCAP-QuoteVerificationLibrary/Src/AttestationLibrary/src/Verifiers/Checks/TdxModuleCheck.cpp:58] [pid:34834] TDX Module - Missing matching Identity (TDX_C1) for given TEE TDX version (193)
Verification results: false
AppLogs:
PCK certificate chain verification OK!
TCB info verification OK!
Quote verification failed with status: STATUS_TDX_MODULE_MISMATCH(85)
```
Contributor guide
Research direction
Start with AttestationApp and Src/AttestationLibrary/src/Verifiers/Checks/TdxModuleCheck.cpp at the logged line 58, then inspect the bundled TDX sample data and TDX identity matching. Run the provided verification command with logging enabled and compare the TDX failure with the successful SGX sample verification. Done means the bundled TDX quote verifies without STATUS_TDX_MODULE_MISMATCH(85).
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cmake, cpp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100