What Is Remote Attestation? How Computers Prove What They're Running

Most cloud security still runs on promises, and remote attestation is how a computer replaces a promise with evidence.

What Is Remote Attestation?

Remote attestation is a process that lets a computer prove to a remote party what software it's running and what hardware it's running on, using cryptographic evidence signed by the hardware itself. The other party checks that evidence before deciding whether to trust the system with data, keys, or a task.

The IETF's standard architecture for the process, RFC 9334, defines it around a simple exchange: one system produces believable information about itself, called evidence, so that a remote party can decide whether to treat it as trustworthy.

How Remote Attestation Works

Remote attestation is often split into three roles:

• Attester: the system proving what it is, such as a server or a confidential virtual machine (CVM).
• Verifier: the service that checks the attester's evidence against known-good values and produces an attestation result.
• Relying party: whoever uses that result to decide whether to trust the attester, such as a client about to send sensitive data.

The process starts inside the hardware. As the attester boots and loads software, its hardware records a measurement (a cryptographic hash) of each component. When a verifier asks for proof, it sends a random value called a nonce, and the attester's hardware signs its measurements together with that nonce using a key only genuine hardware holds. The nonce matters because it stops an attacker from replaying old evidence captured before the system was compromised.

The verifier then checks three things: that the signature traces back to the hardware manufacturer, that the measurements match the software the relying party expects, and when the evidence was attested. Only then does the relying party have established trust.

Remote Attestation Makes Confidential Computing Verifiable

A trusted execution environment (TEE) isolates a workload's memory from the host operating system, the hypervisor, and the people running the infrastructure. Isolation alone doesn't tell anyone outside whether they're talking to a real TEE running the expected code, and remote attestation is what provides that proof.

Intel TDX shows how this works in practice. Its hardware generates a signed proof called a TD Quote, and verifiers check that quote's signature against a certificate chain rooted in Intel's certificate authority, which confirms it came from a genuine Intel CPU. According to Intel, a successful check gives the relying party confidence that the workload is running inside a genuine TDX environment at a known security patch level. Teams can verify quotes through Intel Trust Authority, cloud services such as Microsoft Azure Attestation, or Intel's open-source verification libraries.

Attested TLS Ties Verification to Every Connection

Attested TLS (aTLS) builds remote attestation into the moment a secure connection opens. Before the encrypted channel is established, the client checks the server's attestation evidence and only proceeds if the measurements match an approved version. That stops a client from sending keys or sensitive data to an impostor service that has a valid TLS certificate but isn't running the code it claims to run.

What Remote Attestation Can and Can't Prove

Remote attestation proves that approved code is running on genuine, up-to-date hardware. It doesn't prove that the approved code is free of bugs or safe to trust, so the question of trust moves to whoever decides which measurements count as approved.

Two practices reduce that remaining trust. Reproducible builds let anyone rebuild the software from source and confirm it produces the same measurement, and public logs of approved measurements make it visible when the approved version changes. Teams evaluating any attestation-based service should ask whether both exist.

Why Attestation Matters for Keys and AI Agents

Attestation gives key management a stronger rule than "trust this server": keys and secrets can be released only to environments that pass attestation, so a compromised or swapped-out machine can't receive them.

The same idea works in the other direction for AI agents. With caller attestation, a key can require the agent calling it to prove it's running inside an approved TEE before anything gets signed, which narrows who can use a key down to specific, verified software.

How SpaceComputer KMS Uses Remote Attestation

SpaceComputer KMS runs key operations inside Intel TDX confidential virtual machines, and remote attestation sits at the center of how we're building trust into the service. In our near-term target architecture, attestation-aware clients verify the service's confidential virtual machine measurement before opening an attested TLS connection, and the KMS releases its own unseal secrets only after verifying that the KMS environment is running approved code.

Key-bound Cedar policies can also require caller-side TDX evidence, so a key can refuse requests from callers that can't prove where they're running. Further out, attestation keeps each independent trust domain in KMS verifiable, on Earth and in orbit. Our engineering team details the full design in From KMS to SpaceKMS.

Create an account to start building with SpaceComputer KMS today with 500 free credits to start.

Frequently Asked Questions

Is remote attestation the same as authentication? No. Authentication proves who a system is, while remote attestation proves what software it's running and on what hardware, which is why secure services often use both together.

What is an attestation quote? An attestation quote is the signed evidence a TEE produces, containing measurements of its hardware and software state. On Intel TDX it's called a TD Quote, and its signature traces back to Intel's certificate authority.

Does remote attestation prove software is secure? No. It proves that a specific, approved version of software is running on genuine hardware, so the software itself still needs review, testing, and ideally reproducible builds.

Which hardware supports remote attestation? Common options include Intel TDX, AMD SEV-SNP, AWS Nitro Enclaves, and Trusted Platform Modules (TPMs), each with its own evidence format and verification service.

SpaceComputer is the open, credibly neutral infrastructure layer that connects the space economy, providing the hardware and software standard for verifiable compute across operators, jurisdictions, and satellites, with high security guarantees and verifiability.

Visit our website and documentation to learn more about our Key Management Service. 
Follow us on X (Twitter) and LinkedIn.