Empty TPM key-provider id for stable launch measurement - #777
Merged
Conversation
The TPM app-root public key is derived from a per-instance sealed seed, so measuring it as key-provider id made mr_system/mr_aggregated instance-bound and unusable as a precomputed allowlist identity. Emit and report an empty id for key_provider=tpm (mode remains in the event name / kind); KMS and local provider ids are unchanged.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR makes TPM key-provider launch measurements stable across same-image instances by removing the instance-derived TPM app-root public key from the key-provider “id” used in measurement and compose pinning, leaving the TPM id empty while keeping KMS and local provider ids unchanged.
Changes:
- Update
KeyProvider::id()to return an empty slice for TPM (and add a unit test for this behavior). - Adjust Stage0 runtime “key-provider” event emission so TPM reports
{"name":"tpm","id":""}while local/KMS still emit a hex id. - Update documentation and comments to reflect that TPM has no stable provider id for measurement/pinning.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| dstack/dstack-util/src/system_setup/config_id_verifier.rs | Updates config-id format documentation to clarify TPM uses an empty key-provider id. |
| dstack/dstack-util/src/system_setup.rs | Emits empty TPM key-provider id in runtime event; local/KMS ids come from KeyProvider::id(). |
| dstack/dstack-types/src/lib.rs | Makes TPM KeyProvider::id() empty and adds a regression test. |
| docs/security/cvm-boundaries.md | Documents key_provider_id semantics for kms/local vs empty for tpm/none. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
key_provider = tpm, stop using the instance app-root public key as the provider id.{"name":"tpm","id":""}(mode only);KeyProvider::id()returns empty for TPM.Why
The TPM app-root key is derived from a per-instance sealed seed. Measuring its pubkey made
key-provider→mr_system/mr_aggregatedinstance-bound and unsuitable as a precomputed allowlist identity. Empty id keeps the measured claim as “TPM mode” without an unusable instance fingerprint.Note: This intentionally changes the TPM launch measurement / event payload. Existing quotes that included a non-empty TPM id will not match new replays. Pinning a non-empty
key_provider_idin app-compose for TPM will now fail closed (runtime id is always empty).Test plan
cargo test -p dstack-types key_providerkey_provider_idno_instance_idis set