.\" Copyright 2024 IBM Corp.
.\" s390-tools is free software; you can redistribute it and/or modify
.\" it under the terms of the MIT license. See LICENSE for details.
.\"

.TH pvattest 1 "2024-11-18" "s390-tools" "Attestation Manual"
.nh
.ad l
.SH NAME
\fBpvattest\fP - create, perform, and verify attestation measurements
\fB
.SH SYNOPSIS
.nf
.fam C
pvattest [OPTIONS] <COMMAND>
.fam C
.fi
.SH DESCRIPTION
Create, perform, and verify attestation measurements for IBM Secure Execution
guest systems.
.SH "PVATTEST COMMANDS"
.PP

\fBcreate\fR
.RS 4
Create an attestation measurement request
.RE

.PP

\fBperform\fR
.RS 4
Send the attestation request to the Ultravisor
.RE

.PP

\fBverify\fR
.RS 4
Verify an attestation response
.RE

.PP

\fBcheck\fR
.RS 4
Check if the attestation result matches defined policies
.RE

.SH OPTIONS
.PP
\-v, \-\-verbose
.RS 4
Provide more detailed output.
.RE
.RE
.PP
\-q, \-\-quiet
.RS 4
Provide less output.
.RE
.RE
.PP
\-\-version
.RS 4
Print version information and exit.
.RE
.RE
.PP
\-h, \-\-help
.RS 4
Print help (see a summary with '-h').
.RE
.RE

.SH EXAMPLES
For details refer to the man page of the command.
.PP
Create the request on a trusted system.
.PP
.nf
.fam C
	trusted:~$ pvattest create \-k hkd.crt \-\-cert CA.crt \-\-cert ibmsk.crt \-\-arpk arp.key \-o attreq.bin

.fam T
.fi
On the SE-guest, \fIperform\fP the attestation.
.PP
.nf
.fam C
	seguest:~$ pvattest perform attreq.bin attresp.bin

.fam T
.fi
On a trusted system, \fIverify\fP that the response is correct. Here, the protection key from the creation and the SE-guest’s header is used to \fIverify\fP the measurement.
.PP
.nf
.fam C
	trusted:~$ pvattest verify \-i attresp.bin \-\-arpk arp.key \-\-hdr se_guest.hdr
	trusted:~$ echo $?
	0

.fam T
.fi

If the measurements do not match \fBpvattest\fP exits with code 2 and emits an error message. The SE-guest attestation failed.
.PP
.nf
.fam C
	trusted:~$ pvattest verify \-i wrongresp.bin \-\-arpk arp.key \-\-hdr se_guest.hdr
	ERROR: Attestation measurement verification failed:
	       Calculated and received attestation measurement are not the same.
	trusted:~$ echo $?
	2

.fam T
.fi
.SH "SEE ALSO"
.sp
\fBpvattest-create\fR(1) \fBpvattest-perform\fR(1) \fBpvattest-verify\fR(1) \fBpvattest-check\fR(1)