{"record":{"id":"621e38722e5d4751","repo":"OpenNHP/opennhp","slug":"attestation-verification-failed","errorCode":null,"errorMessage":"attestation verification failed","messagePattern":"attestation verification failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/server/msghandler.go","lineNumber":707,"sourceCode":"\t\t\treturn downloadErr\n\t\t}\n\t\twasmBytes, downloadErr = os.ReadFile(wasmPath)\n\t\tif downloadErr != nil {\n\t\t\treturn downloadErr\n\t\t}\n\t}\n\n\tengine := wasmEngine.NewEngine()\n\terr = engine.LoadWasm(wasmBytes)\n\tdefer engine.Close()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif engine.OnAttestationVerify(attestation) {\n\t\treturn nil\n\t} else {\n\t\treturn fmt.Errorf(\"attestation verification failed\")\n\t}\n}\n\nfunc SaveZdtoConfig(drgMsg *common.DRGMsg) error {\n\tobjectId := drgMsg.DoId\n\tconfigFileName := \"data-\" + objectId + \".json\"\n\n\tetcDir := filepath.Join(ExeDirPath, \"etc\", \"ztdo\")\n\tconfigPath := filepath.Join(etcDir, configFileName)\n\n\tif existingDrgMsg, err := ReadZdtoConfig(objectId); err == nil {\n\t\t// alway keep original date source type\n\t\tdrgMsg.DataSourceType = existingDrgMsg.DataSourceType\n\n\t\tif drgMsg.AccessUrl == \"\" { // provider update access url\n\t\t\tdrgMsg.AccessUrl = existingDrgMsg.AccessUrl\n\t\t}\n","sourceCodeStart":689,"sourceCodeEnd":725,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/server/msghandler.go#L689-L725","documentation":"DHP device attestation verification failed in onAttestationVerify. The server loaded the WASM engine and ran its OnAttestationVerify hook on the submitted attestation, and the hook returned false — the attestation evidence did not prove the device/client is trustworthy. The NHP_DAV message is rejected.","triggerScenarios":"HandleDHPDAVMessage processes an attestation message whose evidence (measurement, signature, or wasm-verified policy check) fails inside engine.OnAttestationVerify, e.g. tampered client, stale/incorrect attestation report, or a WASM policy build that rejects the provided data.","commonSituations":"A client with an outdated attestation binary or a modified runtime attempts confidential-computing access; a WASM attestation policy was updated on the server and older clients no longer pass; attestation blob was corrupted in transit or re-serialized incorrectly.","solutions":["Regenerate/refresh the attestation report on the client side so its measurements match current software.","Confirm the server's WASM attestation policy module matches the attestation format the client produces.","Verify the attestation bytes are not altered between client and server (encoding/transport integrity).","Check client and server versions are in lockstep; update the older side."],"exampleFix":"// before: client sends cached/old attestation from previous firmware\nattestation := loadCachedAttestation()\n// after: produce a fresh attestation for the current runtime\nattestation := generateFreshAttestation(currentRuntimeMeasurements())","handlingStrategy":"try-catch","validationCode":"// client-side pre-check: ensure attestation is fresh and matches current measurements\nif attestation.IsExpired() || attestation.Measurement != currentRuntimeMeasurement() {\n    attestation = regenerateAttestation()\n}","typeGuard":"func attestationUsable(a *Attestation) bool {\n    return a != nil && len(a.Evidence) > 0 && !a.IsExpired()\n}","tryCatchPattern":"err := sendDHPDAV(attestation)\nif err != nil && strings.Contains(err.Error(), \"attestation verification failed\") {\n    attestation = regenerateAttestation() // refresh evidence and retry once\n    err = sendDHPDAV(attestation)\n}","preventionTips":["Regenerate attestations on every software/firmware update.","Keep client attestation format and server WASM policy versions in lockstep.","Sign and integrity-protect attestation blobs in transport to rule out corruption."],"tags":["attestation","confidential-computing","security"],"backgroundTag":"attestation-verification-failed","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}