OpenNHP/opennhp · error

attestation verification failed

Error message

attestation verification failed

What it means

DHP device attestation verification failed in onAttestationVerify. The server loaded the WASM engine and ran its OnAttestationVerify hook on the submitted attestation, and the hook returned false — the attestation evidence did not prove the device/client is trustworthy. The NHP_DAV message is rejected.

Solutions

1. Regenerate/refresh the attestation report on the client side so its measurements match current software.
2. Confirm the server's WASM attestation policy module matches the attestation format the client produces.
3. Verify the attestation bytes are not altered between client and server (encoding/transport integrity).
4. Check client and server versions are in lockstep; update the older side.

Example fix

// before: client sends cached/old attestation from previous firmware
attestation := loadCachedAttestation()
// after: produce a fresh attestation for the current runtime
attestation := generateFreshAttestation(currentRuntimeMeasurements())

// client-side pre-check: ensure attestation is fresh and matches current measurements
if attestation.IsExpired() || attestation.Measurement != currentRuntimeMeasurement() {
    attestation = regenerateAttestation()
}

func attestationUsable(a *Attestation) bool {
    return a != nil && len(a.Evidence) > 0 && !a.IsExpired()
}

err := sendDHPDAV(attestation)
if err != nil && strings.Contains(err.Error(), "attestation verification failed") {
    attestation = regenerateAttestation() // refresh evidence and retry once
    err = sendDHPDAV(attestation)
}

When it happens

Trigger: HandleDHPDAVMessage processes an attestation message whose evidence (measurement, signature, or wasm-verified policy check) fails inside engine.OnAttestationVerify, e.g. tampered client, stale/incorrect attestation report, or a WASM policy build that rejects the provided data.

Common situations: A client with an outdated attestation binary or a modified runtime attempts confidential-computing access; a WASM attestation policy was updated on the server and older clients no longer pass; attestation blob was corrupted in transit or re-serialized incorrectly.

Related errors

• unsupported key type, expect RSA
• JWT signing key is not initialized
• TEE public key is not found for specified token
• invalid resource ID: potential path traversal attack
• Failed to refresh SDP

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/621e38722e5d4751. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/server/msghandler.go:707

			return downloadErr
		}
		wasmBytes, downloadErr = os.ReadFile(wasmPath)
		if downloadErr != nil {
			return downloadErr
		}
	}

	engine := wasmEngine.NewEngine()
	err = engine.LoadWasm(wasmBytes)
	defer engine.Close()
	if err != nil {
		return err
	}

	if engine.OnAttestationVerify(attestation) {
		return nil
	} else {
		return fmt.Errorf("attestation verification failed")
	}
}

func SaveZdtoConfig(drgMsg *common.DRGMsg) error {
	objectId := drgMsg.DoId
	configFileName := "data-" + objectId + ".json"

	etcDir := filepath.Join(ExeDirPath, "etc", "ztdo")
	configPath := filepath.Join(etcDir, configFileName)

	if existingDrgMsg, err := ReadZdtoConfig(objectId); err == nil {
		// alway keep original date source type
		drgMsg.DataSourceType = existingDrgMsg.DataSourceType

		if drgMsg.AccessUrl == "" { // provider update access url
			drgMsg.AccessUrl = existingDrgMsg.AccessUrl
		}

View on GitHub (pinned to 6e04ca5ff0)