Skip to main content
Nito performs a baseline verification: it confirms the evidence is present, well-formed, carries its signing material, is bound to a fresh value you supplied, and is bound to the model that served the call. Nito does not perform the full hardware verification. Validating the raw hardware evidence and its certificate chains is yours to do on top of the baseline. That is the point of this path: the raw evidence comes back to you so that you, not Nito, are the final verifier.

Supply a fresh value

Generate a fresh, unpredictable value from a cryptographically secure source, at least 32 bytes, and never reuse one. Replay protection is caller-driven, so this is what makes the freshness gates meaningful. See the report-data binding.

Fetch the attestation

Request the attestation backing a Confidential call, passing the value from step 1. What comes back is a signed statement plus the raw hardware evidence.

Run the independent checks

Do not take a verified flag at face value. Re-check these in your own code:
  1. The response arrived cleanly and is the attestation you asked for.
  2. A model is named and the result reports the Confidential level as available.
  3. The echoed value matches the one you sent. If it does not, stop: the proof is not bound to your request.
  4. The raw evidence is present and non-empty.
  5. The proof metadata is present: a proof-format label, a signing algorithm, and the model public key.
  6. The baseline verification passed.
If any check fails, treat the attestation as untrustworthy and do not proceed with the sensitive workload.

Complete the hardware verification

Steps 1 through 3 give you a baseline-verified result. For full assurance, verify the raw hardware evidence yourself: validate the hardware quote and any accelerator evidence it contains, walk the certificate chains up to the vendor certificates, and check them against current revocation and trust policy. See the scope limit on the seven-gate baseline.

The Seven-Gate Baseline

What the baseline covers, and what it does not.

Report-Data Binding

Why step 1 comes first.

Per-Provider Attestation

Why evidence can differ by backend.