Appendix: Apple Silicon Attestation Bundle Contents

Overview

Attestation bundles are Protobuf-encoded data structures with the following schema:

message AttestationBundle {
    bytes sep_attestation = 1; // DER-encoded SEP attestation
    bytes ap_ticket = 2; // DER-encoded AP Image4 manifest
    SealedHashLedger sealed_hashes = 3;
    repeated bytes provisioning_certificate_chain = 4;
    bytes app_data = 5; // Application-case specific metadata. Authenticated via SEP attestation anti-replay value.
    google.protobuf.Timestamp key_expiration = 6; // Unix timestamp of the key's expiration, as hinted by the attested device
    TransparencyProofs transparency_proofs = 8;
}

message SealedHashLedger {
    map<string, SealedHash> slots = 1;
}

message SealedHash {
    HashAlg hash_alg = 1;
    repeated Entry entries = 2;

    message Entry {
        int32 flags = 1; // Flags set for the sealed hash update
        bytes digest = 2; // The bytes ratcheted into the software sealed register

        oneof info {
            Cryptex cryptex = 3; // Cryptex entry
            Cryptex.Salt cryptex_salt = 4; // libCryptex defined value that serves as an end marker for a register
            SecureConfig secure_config = 5; // SecureConfig Entry
        }

        map<string, bytes> metadata = 6;
    }
}

enum HashAlg {
    HASH_ALG_UNKNOWN = 0;
    HASH_ALG_SHA256 = 1;
    HASH_ALG_SHA384 = 2;
}

message Cryptex {
    bytes image4_manifest = 1; // DER-encoded cryptex Image4 manifest

    message Salt {
    }
}

message SecureConfig {
    bytes entry = 1; // JSON-encoded darwin-init config
    map<string, string> metadata = 2;
    bytes data = 3; // The metadata, a newline, and the entry, concatenated
}

message AppData {
    uint32 version = 1;
    string domain = 2; // Always "com.apple.PrivateCloudCompute"
    string name = 3; // Distinguishes proxy nodes from inferencing nodes
    google.protobuf.Any metadata = 4; // AttestationAppData for inferencing nodes, ProxyNodeMetadata for proxy nodes
}

message AttestationAppData {
    bytes rackId = 1;
    bytes ensembleId = 2;
    bytes bootId = 3;
}

message ProxyNodeMetadata {
    message ProxiedRelease {
        bytes digest = 1;
        proto.TransparencyProofs transparency_proofs = 2;
    }

    repeated ProxiedRelease proxied_release = 1; // Legacy trusted release set; 6A and later carry the proxy's own release only.
}

message TransparencyProofs {
    ATLogProofs proofs = 1;
}

The digest a node ratchets for a secure-config entry covers the metadata, a newline, and the entry, concatenated in order.

The public part of the PCC node’s Attested Request Handling (REK) is released only under these conditions: