Try to break it

We take a genuine receipt (real enclave evidence, demo answer) and forge it twelve ways. Your browser runs the same verifier as npm run verify on each forgery. The same list runs in the test suite (test/attacks.test.ts).

1
Change the answer
Flip the verdict to 'agrees with the report' after the fact.
not run
2
Add a question the model never asked
Append a reassuring line to the questions for the doctor.
not run
3
Swap in another enclave's attestation
Replace the evidence with a different model's genuine evidence.
not run
4
Swap the attestation and fix up its hash
Same swap, then recompute the attestation hash so it matches.
not run
5
Replay old enclave evidence
Present yesterday's genuine evidence as the answer to a fresh request (new nonce).
not run
6
Run a different model image
Point the measured configuration at an attacker's container image.
not run
7
Claim a different model answered
Relabel the receipt as coming from another model id.
not run
8
Forge the hardware quote
Change one byte inside the Intel TDX quote.
not run
9
Tamper with the encrypted reply
Alter the sealed response bytes the relay passed back.
not run
10
Sign the answer with my own key
Claim a live answer and attach a valid signature from a key that is not the enclave's.
not run
11
Claim a live answer with no signature
Mark a demo receipt as 'live' and hope nobody asks for the enclave's signature.
not run
12
Say it was encrypted to a different key
Replace the recorded enclave key with an attacker's key.
not run