ra-tls-verify

RA-TLS attestation verification for dstack TEE services.

Extract and verify TDX attestation quotes from RA-TLS X.509 certificates. Python equivalent of prisma-ra-tls's verification layer.

Install

pip install ra-tls-verify

Usage

Extract a TDX quote from an RA-TLS certificate

from ra_tls_verify import extract_tdx_quote

quote = extract_tdx_quote(der_cert_bytes)
if quote is None:
    print("Not an RA-TLS certificate")

Verify via Intel Trust Authority

import asyncio
from ra_tls_verify import IntelApiVerifier, VerifyOptions

verifier = IntelApiVerifier(api_key="your-ita-key")
result = asyncio.run(verifier.verify(quote))
print(f"MRTD: {result.mr_td}")
print(f"TCB:  {result.tcb_status}")

Development / simulator

from ra_tls_verify import NoopVerifier

verifier = NoopVerifier()  # accepts any quote

License

Apache-2.0