1. Manuals
  2. Tumbleweed
  3. s390-tools
  4. pvattest(1)

Scroll to navigation

PVATTEST(1) Attestation Manual PVATTEST(1)

NAME

pvattest - create, perform, and verify attestation measurements

SYNOPSIS



 pvattest [OPTIONS] <COMMAND>

DESCRIPTION

Create, perform, and verify attestation measurements for IBM Secure Execution guest systems.

PVATTEST COMMANDS

pvattest-create(1)

Create an attestation measurement request.

Create attestation measurement requests to attest an IBM Secure Execution guest. Only build attestation requests in a trusted environment such as your Workstation. To avoid compromising the attestation do not publish the attestation request protection key and shred it after verification. Every create will generate a new, random protection key.

pvattest-perform(1)

Send the attestation request to the Ultravisor (s390x only.)

Run a measurement of this system through /dev/uv. This device must be accessible and the attestation Ultravisor facility must be present. The input must be an attestation request created with pvattest create. Output will contain the original request and the response from the Ultravisor. Only available on s390x.

pvattest-verify(1)

Verify an attestation response.

Verify that a previously generated attestation measurement of an IBM Secure Execution guest is as expected. Only verify attestation requests in a trusted environment, such as your workstation. Input must contain the response as produced by pvattest perform. The protection key must be the one that was used to create the request by pvattest create. Shred the protection key after the verification. The header must be the IBM Secure Execution header of the image that was attested during pvattest perform. The verify command solely verifies that the Attestation measurement is correct. It does not check for the content of additional data or user data. See `pvattest check` for policy checks after you verified the Attestation measurement.

pvattest-check(1)

Check if the attestation result matches defined policies.

After the attestation verification, check whether the attestation result complies with user-defined policies.

OPTIONS

-v, --verbose

Provide more detailed output.

-q, --quiet

Provide less output.

--version

Print version information and exit.

-h, --help

Print help (see a summary with -h).

EXAMPLES

For details refer to the man page of the command.

Create the request on a trusted system.

	trusted:~$ pvattest create -k hkd.crt --cert CA.crt --cert ibmsk.crt --arpk arp.key -o attreq.bin
On the SE-guest, perform the attestation. 

	seguest:~$ pvattest perform attreq.bin attresp.bin
On a trusted system, verify that the response is correct. Here, the protection key from the creation and the SE-guest’s header is used to verify the measurement. 

	trusted:~$ pvattest verify -i attresp.bin --arpk arp.key --hdr se_guest.hdr
	trusted:~$ echo $?
	0

If the measurements do not match pvattest exits with code 2 and emits an error message. The SE-guest attestation failed.

	trusted:~$ pvattest verify -i wrongresp.bin --arpk arp.key --hdr se_guest.hdr
	ERROR: Attestation measurement verification failed:
	       Calculated and received attestation measurement are not the same.
	trusted:~$ echo $?
	2

SEE ALSO

pvattest-create(1), pvattest-perform(1), pvattest-verify(1), pvattest-check(1)

2026-08-11 s390-tools