Forum Discussion
Usage of GetRuntimeAttestationReport
Hello Community!
I would like to get more information about the function GetRuntimeAttestationReport.
It seems like it is signed via a key from the Secure Kernel, but the key's getter function is unknown to me. How does one query this key? Also, how does one verify the key's root of trust?
Sincerely
Robert
1 Reply
GetRuntimeAttestationReport returns a signed package, but Microsoft’s public documentation does not expose a function for retrieving the Secure Kernel signing key or describe a standalone certificate-chain validation procedure. The documented model is backend validation, not local extraction of a trusted key. Generate a fresh cryptographically random 32-byte nonce on your verifier, call the API once with a null report buffer to obtain the size, then call it again using the current package version and required report-type mask. Preserve the complete package, including its header, nonce, digest headers, signature blob, and authenticated reports, and send it unchanged to the trusted backend. Confirm TPM 2.0, Secure Boot, VBS, HVCI, and IOMMU are enabled and test-signing and debugging are disabled. If you are building your own verifier, the published API contract is insufficient to establish Microsoft’s root of trust; request the validation protocol or supported attestation service from Microsoft.
