kms: require attestation for all KMS flows

Author: kvinwang

docs/deployment.md

@@ -459,8 +459,7 @@ Additional KMS instances can onboard from an existing KMS to share the same root
 ```toml
 [core.onboard]
 enabled = true
-auto_bootstrap_domain = ""   # Empty = onboard mode
-quote_enabled = true         # Require TDX attestation
+auto_bootstrap_domain = ""   # Empty = onboard mode         # Require TDX attestation
 address = "0.0.0.0"
 port = 9203                  # HTTP port for onboard UI
 ```
@@ -480,7 +479,7 @@ curl http://<new-kms>:9203/finish
 # Restart KMS - it will now serve as a full KMS with shared keys
 ```
 
-> **Note:** For KMS onboarding with `quote_enabled = true`, add the KMS mrAggregated hash to your auth server's `kms.mrAggregated` whitelist.
+> **Note:** KMS onboarding requires attested KMS instances. Add the KMS `mrAggregated` hash to your auth server's `kms.mrAggregated` whitelist.
 
 ---
 

docs/tutorials/kms-build-configuration.md

@@ -207,7 +207,6 @@ url = "http://127.0.0.1:9200"
 [core.onboard]
 enabled = true
 auto_bootstrap_domain = ""
-quote_enabled = true
 address = "0.0.0.0"
 port = 9100
 EOF
@@ -495,7 +494,6 @@ enabled = true
 # Empty domain = manual bootstrap mode (ensures bootstrap-info.json is written)
 auto_bootstrap_domain = ""
 # Enable TDX quotes - works because KMS runs in CVM
-quote_enabled = true
 address = "0.0.0.0"
 port = 9100
 EOF

docs/tutorials/kms-cvm-deployment.md

@@ -188,7 +188,6 @@ configs:
       [core.onboard]
       enabled = true
       auto_bootstrap_domain = ""
-      quote_enabled = true
       address = "0.0.0.0"
       port = 9100
 EOF

docs/tutorials/troubleshooting-kms-deployment.md

@@ -241,7 +241,7 @@ export DSTACK_VMM_AUTH_PASSWORD=$(cat ~/.dstack/secrets/vmm-auth-token)
 "quote": null
 ```
 
-This indicates quote_enabled might be false, guest-agent issues, or **SGX not properly configured**:
+This indicates guest-agent issues, simulator misconfiguration, or **SGX not properly configured**:
 
 ```bash
 # Check CVM logs for TDX-related errors (replace VM_ID with actual ID from lsvm)
@@ -259,9 +259,7 @@ curl -s -H "Authorization: Bearer $(cat ~/.dstack/secrets/vmm-auth-token)" \
 
 2. **SGX Auto MP Registration not enabled** - Without this BIOS setting, your platform isn't registered with Intel's PCS, and attestation quotes cannot be verified. Re-enter BIOS and enable "SGX Auto MP Registration".
 
-3. **quote_enabled is false** - Verify your `kms.toml` has `quote_enabled = true` in the `[core.onboard]` section.
-
-4. **Guest-agent not running** - The `/var/run/dstack.sock` socket must exist inside the CVM.
+3. **Guest-agent / simulator not running** - The KMS must be able to reach a working dstack guest agent endpoint. In a real CVM, `/var/run/dstack.sock` must exist. For local development, start `sdk/simulator` first.
 
 ### CVM Fails with "QGS error code: 0x12001"
 

kms/dstack-app/compose-dev.yaml

@@ -80,6 +80,5 @@ configs:
       [core.onboard]
       enabled = true
       auto_bootstrap_domain = ""
-      quote_enabled = true
       address = "0.0.0.0"
       port = 8000

kms/dstack-app/compose-simple.yaml

@@ -56,6 +56,5 @@ configs:
       [core.onboard]
       enabled = true
       auto_bootstrap_domain = ""
-      quote_enabled = true
       address = "0.0.0.0"
       port = 8000

kms/kms.toml

@@ -45,6 +45,5 @@ gateway_app_id = "any"
 [core.onboard]
 enabled = true
 auto_bootstrap_domain = ""
-quote_enabled = true
 address = "0.0.0.0"
 port = 8000

kms/src/config.rs

@@ -118,6 +118,5 @@ pub(crate) struct Dev {
 #[derive(Debug, Clone, Deserialize)]
 pub(crate) struct OnboardConfig {
     pub enabled: bool,
-    pub quote_enabled: bool,
     pub auto_bootstrap_domain: String,
 }

kms/src/main_service.rs

@@ -99,9 +99,6 @@ struct BootConfig {
 
 impl RpcHandler {
     async fn ensure_self_allowed(&self) -> Result<()> {
-        if !self.state.config.onboard.quote_enabled {
-            return Ok(());
-        }
         let boot_info = self
             .state
             .self_boot_info
@@ -355,9 +352,7 @@ impl KmsRpc for RpcHandler {
         self.ensure_self_allowed()
             .await
             .context("KMS self authorization failed")?;
-        if self.state.config.onboard.quote_enabled {
-            let _info = self.ensure_kms_allowed(&request.vm_config).await?;
-        }
+        let _info = self.ensure_kms_allowed(&request.vm_config).await?;
         Ok(KmsKeyResponse {
             temp_ca_key: self.state.inner.temp_ca_key.clone(),
             keys: vec![KmsKeys {

kms/src/onboard_service.rs

@@ -60,29 +60,22 @@ impl RpcCall<OnboardState> for OnboardHandler {
 
 impl OnboardRpc for OnboardHandler {
     async fn bootstrap(self, request: BootstrapRequest) -> Result<BootstrapResponse> {
-        let quote_enabled = self.state.config.onboard.quote_enabled;
-        if quote_enabled {
-            ensure_self_kms_allowed(&self.state.config)
-                .await
-                .context("KMS is not allowed to bootstrap")?;
-        }
-        let keys = Keys::generate(&request.domain, quote_enabled)
+        ensure_self_kms_allowed(&self.state.config)
+            .await
+            .context("KMS is not allowed to bootstrap")?;
+        let keys = Keys::generate(&request.domain)
             .await
             .context("Failed to generate keys")?;
 
         let k256_pubkey = keys.k256_key.verifying_key().to_sec1_bytes().to_vec();
         let ca_pubkey = keys.ca_key.public_key_der();
-        let attestation = if quote_enabled {
-            Some(attest_keys(&ca_pubkey, &k256_pubkey).await?)
-        } else {
-            None
-        };
+        let attestation = attest_keys(&ca_pubkey, &k256_pubkey).await?;
 
         let cfg = &self.state.config;
         let response = BootstrapResponse {
             ca_pubkey,
             k256_pubkey,
-            attestation: attestation.unwrap_or_default(),
+            attestation,
         };
         // Store the bootstrap info
         safe_write(cfg.bootstrap_info(), serde_json::to_vec(&response)?)?;
@@ -101,7 +94,6 @@ impl OnboardRpc for OnboardHandler {
             &self.state.config,
             &source_url,
             &request.domain,
-            self.state.config.onboard.quote_enabled,
             self.state.config.pccs_url.clone(),
         )
         .await
@@ -169,12 +161,12 @@ struct Keys {
 }
 
 impl Keys {
-    async fn generate(domain: &str, quote_enabled: bool) -> Result<Self> {
+    async fn generate(domain: &str) -> Result<Self> {
         let tmp_ca_key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256)?;
         let ca_key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256)?;
         let rpc_key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256)?;
         let k256_key = SigningKey::random(&mut rand::rngs::OsRng);
-        Self::from_keys(tmp_ca_key, ca_key, rpc_key, k256_key, domain, quote_enabled).await
+        Self::from_keys(tmp_ca_key, ca_key, rpc_key, k256_key, domain).await
     }
 
     async fn from_keys(
@@ -183,7 +175,6 @@ impl Keys {
         rpc_key: KeyPair,
         k256_key: SigningKey,
         domain: &str,
-        quote_enabled: bool,
     ) -> Result<Self> {
         let tmp_ca_cert = CertRequest::builder()
             .org_name("Dstack")
@@ -201,25 +192,20 @@ impl Keys {
             .key(&ca_key)
             .build()
             .self_signed()?;
-        let attestation = if quote_enabled {
-            let pubkey = rpc_key.public_key_der();
-            let report_data = QuoteContentType::RaTlsCert.to_report_data(&pubkey);
-            let response = app_attest(report_data.to_vec())
-                .await
-                .context("Failed to get quote")?;
-            let attestation = VersionedAttestation::from_scale(&response.attestation)
-                .context("Invalid attestation")?;
-            Some(attestation)
-        } else {
-            None
-        };
+        let pubkey = rpc_key.public_key_der();
+        let report_data = QuoteContentType::RaTlsCert.to_report_data(&pubkey);
+        let response = app_attest(report_data.to_vec())
+            .await
+            .context("Failed to get quote")?;
+        let attestation = VersionedAttestation::from_scale(&response.attestation)
+            .context("Invalid attestation")?;
 
         // Sign WWW server cert with KMS cert
         let rpc_cert = CertRequest::builder()
             .subject(domain)
             .alt_names(&[domain.to_string()])
             .special_usage("kms:rpc")
-            .maybe_attestation(attestation.as_ref())
+            .maybe_attestation(Some(&attestation))
             .key(&rpc_key)
             .build()
             .signed_by(&ca_cert, &ca_key)?;
@@ -239,54 +225,44 @@ impl Keys {
         cfg: &KmsConfig,
         other_kms_url: &str,
         domain: &str,
-        quote_enabled: bool,
         pccs_url: Option<String>,
     ) -> Result<Self> {
-        let mut source_attestation_slot = None;
-        let mut kms_client = if quote_enabled {
-            let attestation_slot = Arc::new(Mutex::new(None::<VerifiedAttestation>));
-            let attestation_slot_out = attestation_slot.clone();
-            let client = RaClientConfig::builder()
-                .tls_no_check(true)
-                .remote_uri(other_kms_url.to_string())
-                .cert_validator(Box::new(move |info: Option<CertInfo>| {
-                    let Some(info) = info else {
-                        bail!("Source KMS did not present a TLS certificate");
-                    };
-                    let Some(attestation) = info.attestation else {
-                        bail!("Source KMS certificate does not contain attestation");
-                    };
-                    let mut slot = attestation_slot_out
-                        .lock()
-                        .map_err(|_| anyhow::anyhow!("source attestation mutex poisoned"))?;
-                    *slot = Some(attestation);
-                    Ok(())
-                }))
-                .maybe_pccs_url(pccs_url.clone())
-                .build()
-                .into_client()?;
-            source_attestation_slot = Some(attestation_slot);
-            KmsClient::new(client)
-        } else {
-            KmsClient::new(RaClient::new(other_kms_url.into(), true)?)
-        };
-
-        if quote_enabled {
-            let tmp_ca = kms_client.get_temp_ca_cert().await?;
-            let (ra_cert, ra_key) = gen_ra_cert(tmp_ca.temp_ca_cert, tmp_ca.temp_ca_key).await?;
-            let ra_client = RaClient::new_mtls(other_kms_url.into(), ra_cert, ra_key, pccs_url)
-                .context("Failed to create client")?;
-            kms_client = KmsClient::new(ra_client);
-            let source_attestation = source_attestation_slot
-                .context("source attestation slot missing")?
-                .lock()
-                .map_err(|_| anyhow::anyhow!("source attestation mutex poisoned"))?
-                .clone()
-                .context("Missing source KMS attestation")?;
-            ensure_remote_kms_allowed(cfg, &source_attestation)
-                .await
-                .context("Source KMS is not allowed for onboarding")?;
-        }
+        let attestation_slot = Arc::new(Mutex::new(None::<VerifiedAttestation>));
+        let attestation_slot_out = attestation_slot.clone();
+        let client = RaClientConfig::builder()
+            .tls_no_check(true)
+            .remote_uri(other_kms_url.to_string())
+            .cert_validator(Box::new(move |info: Option<CertInfo>| {
+                let Some(info) = info else {
+                    bail!("Source KMS did not present a TLS certificate");
+                };
+                let Some(attestation) = info.attestation else {
+                    bail!("Source KMS certificate does not contain attestation");
+                };
+                let mut slot = attestation_slot_out
+                    .lock()
+                    .map_err(|_| anyhow::anyhow!("source attestation mutex poisoned"))?;
+                *slot = Some(attestation);
+                Ok(())
+            }))
+            .maybe_pccs_url(pccs_url.clone())
+            .build()
+            .into_client()?;
+        let mut kms_client = KmsClient::new(client);
+
+        let tmp_ca = kms_client.get_temp_ca_cert().await?;
+        let (ra_cert, ra_key) = gen_ra_cert(tmp_ca.temp_ca_cert, tmp_ca.temp_ca_key).await?;
+        let ra_client = RaClient::new_mtls(other_kms_url.into(), ra_cert, ra_key, pccs_url)
+            .context("Failed to create client")?;
+        kms_client = KmsClient::new(ra_client);
+        let source_attestation = attestation_slot
+            .lock()
+            .map_err(|_| anyhow::anyhow!("source attestation mutex poisoned"))?
+            .clone()
+            .context("Missing source KMS attestation")?;
+        ensure_remote_kms_allowed(cfg, &source_attestation)
+            .await
+            .context("Source KMS is not allowed for onboarding")?;
 
         let info = dstack_client().info().await.context("Failed to get info")?;
         let keys_res = kms_client
@@ -308,15 +284,7 @@ impl Keys {
             KeyPair::from_pem(&tmp_ca_key_pem).context("Failed to parse tmp CA key")?;
         let ecdsa_key =
             SigningKey::from_slice(&root_k256_key).context("Failed to parse ECDSA key")?;
-        Self::from_keys(
-            tmp_ca_key,
-            ca_key,
-            rpc_key,
-            ecdsa_key,
-            domain,
-            quote_enabled,
-        )
-        .await
+        Self::from_keys(tmp_ca_key, ca_key, rpc_key, ecdsa_key, domain).await
     }
 
     fn store(&self, cfg: &KmsConfig) -> Result<()> {
@@ -360,16 +328,9 @@ pub(crate) async fn update_certs(cfg: &KmsConfig) -> Result<()> {
     let domain = domain.trim();
 
     // Regenerate certificates using existing keys
-    let keys = Keys::from_keys(
-        tmp_ca_key,
-        ca_key,
-        rpc_key,
-        k256_key,
-        domain,
-        cfg.onboard.quote_enabled,
-    )
-    .await
-    .context("Failed to regenerate certificates")?;
+    let keys = Keys::from_keys(tmp_ca_key, ca_key, rpc_key, k256_key, domain)
+        .await
+        .context("Failed to regenerate certificates")?;
 
     // Write the new certificates to files
     keys.store_certs(cfg)?;
@@ -378,17 +339,12 @@ pub(crate) async fn update_certs(cfg: &KmsConfig) -> Result<()> {
 }
 
 pub(crate) async fn bootstrap_keys(cfg: &KmsConfig) -> Result<()> {
-    if cfg.onboard.quote_enabled {
-        ensure_self_kms_allowed(cfg)
-            .await
-            .context("KMS is not allowed to auto-bootstrap")?;
-    }
-    let keys = Keys::generate(
-        &cfg.onboard.auto_bootstrap_domain,
-        cfg.onboard.quote_enabled,
-    )
-    .await
-    .context("Failed to generate keys")?;
+    ensure_self_kms_allowed(cfg)
+        .await
+        .context("KMS is not allowed to auto-bootstrap")?;
+    let keys = Keys::generate(&cfg.onboard.auto_bootstrap_domain)
+        .await
+        .context("Failed to generate keys")?;
     keys.store(cfg)?;
     Ok(())
 }