Skip to main content
Nito brokers attestation and hands you the evidence in full. The hardware verification is yours. The full picture, including what Nito checks before every Confidential call, is on How Attestation Works.

​
Fetch with a Fresh Challenge

32 bytes from a cryptographically secure source, hex encoded, never reused. Freshness lives inside the evidence’s report data, so a reused challenge proves nothing.

​
Structural Checks

  • Status 200 and object equal to attestation.
  • attestation_available is true and evidence is non-empty.
  • nonce equals the challenge you sent.
  • proof_format, signing_algo, and model_public_key are present.

​
Cryptographic Checks

Run these against the raw evidence bytes. They are what gives assurance. Today’s backends run Intel TDX with NVIDIA GPUs, and proof_format names the exact layout.
  • The Intel TDX quote. Validate it with Intel’s DCAP quote-verification library: certificate chain, collateral, revocation and TCB status, measurements. Confirm your challenge appears in the quote’s report_data.
  • The NVIDIA GPU evidence, where present. Validate it with the NVIDIA Remote Attestation Service (NRAS) at https://nras.attestation.nvidia.com/v3/attest/gpu.
  • The bindings. Confirm the model identity, the signing key, and, where the backend commits to it, the model public key in the evidence match the top-level fields and the model you asked for.
verified is always false, and the signing fields are as observed from the backend. They exist so a client can build an encryption context.

​
The Broker Boundary

Verification needs a platform-specific quote library and a measurement policy only the caller can own. Keeping it on the client removes a party you would otherwise have to trust and keeps the evidence unaltered between the backend and you.

​
Response Signatures

After verifying attestation, an Encrypted API client can request Response Evidence on supported nonstreaming calls. The returned original body bytes and signature proof let your client check whether the response is bound to the verified signing identity. Nito leaves verified as false; this requires a separate client-side signature check.