security: make cnf.jwk<->report_data binding fatal for SEV-SNP/TDX; fix TDX report_data offset

[imran-siddique]

Tracked follow-up from the June 2026 org-wide security hardening review. Wave 1/2 fixes are merged and published; this is remaining hardening.

For SEV-SNP/TDX the cnf.jwk<->report_data binding is currently advisory (non-fatal) and the TDX report_data is read from a best-effort/likely-wrong offset. Extract report_data from the parsed raw_evidence at the correct documented offset and require it to equal jwk_thumbprint(cnf.jwk.x); a mismatch must be fatal for all hardware platforms.

[imran-siddique]

Status: the cnf/report_data binding is now fail-closed via PR #386 (SNP). The TDX report_data offset will be pinned by the capture script's known report_data prefix (cmcp-tdx-fixture-v1) once the Azure TDX quote fixture lands; the TDX scaffold PR carries a skipped test that asserts the offset then.

[imran-siddique]

Status note on the TDX portion of this issue, after auditing src/cmcp_verify/tdx.py on main.

Already done (no action needed):

• SNP report_data binding is now fatal (fix(verify): make SNP report_data binding fatal and never report VERIFIED without a verified VCEK chain (#371) #390, merged).
• The TDX DCAP quote path is correct and fail-closed: verify_tdx_quote reads report_data at _TD_BODY_REPORT_DATA_OFF = 520 (the TD-body offset, added in fix(verify): offline DCAP TDX quote verification (cmcp#370) #387 referencing this issue) and sets failure_reason = "report_data_mismatch" on a mismatch. This is the real attestation path.

Residual (the part still open):
verify_tdx_measurement (the raw-TDREPORT branch, ~lines 138-148) still:

1. reads report_data from raw_evidence[0x08:0x08+64], and
2. treats a mismatch as non-fatal (it only appends report_data to verified_fields on a match; a mismatch is silently ignored).

Two cautions for whoever picks this up:

• The 0x08 offset is flagged in-code as "best-effort / varies by TDREPORT version." Note the _TdReport struct places mrtd at 0x90, which does not match a standard Intel TDREPORT_STRUCT (MRTD lives in TDINFO around 0x200). So this branch appears to parse a cmcp-specific / mock TDREPORT layout, and the correct report_data offset for that input is defined by the gateway's evidence encoding, not derivable from the verifier alone. It should be fixed with the authoritative offset (ideally exposed as a named field on _TdReport, like SNP's report.report_data), not a guessed constant.
• Making the check fatal requires the correct offset first: with 0x08 (reserved bytes) a fatal check would fail every legitimate verification.

Suggested fix: add report_data as a named field on _TdReport at the gateway-defined offset, then, when report_data_hex is provided, set verified = False / failure_reason = "report_data_mismatch" on a mismatch, mirroring the merged SNP fix (#390) and the quote path.

(For cross-reference: TPM's analogous qualifying_data binding is being reworked on fix/tpm-verifier-qualifying-data.)

Flagging rather than patching because the offset depends on the gateway TDREPORT encoding, which the #387 authors own.

[imran-siddique]

Residual scope (post #387/#390)

The DCAP-quote path is fixed (offset 520, fail-closed, #387) and SNP binding is fatal (#390). One branch is still wrong: the raw-TDREPORT report_data check.

Where: src/cmcp_verify/tdx.py, verify_tdx_measurement, lines ~138-148.
Defect: (1) reads report_data at a guessed offset 0x08 (line 143); for a raw TDREPORT (REPORTMACSTRUCT-first) REPORTDATA sits inside REPORTMACSTRUCT at offset ~0x80, not 0x08. (2) On mismatch it falls through with no result.verified = False (lines 147-148), so a TDREPORT with a matching MRTD but a report_data bound to a different enclave still verifies. Same class of hole #390 closed for SNP.

Fix: model report_data as a named field at the confirmed offset (validate against a real quote, do not guess again); make a mismatch fatal, mirroring sev_snp.py lines 298-302 (verified=False, failure_reason="report_data_mismatch").
Test: tests/unit/test_tdx_opaque_verify.py already builds synthetic TDREPORTs via _make_tdreport; add match -> field present and mismatch -> fatal. Effort S.
Blocker: the exact raw-TDREPORT offset must be locked with a real Azure TDX vector (capture-tdx-azure.sh); no tests/fixtures/ exist yet. Recommend landing the fail-closed logic behind the confirmed offset gated by that fixture, not another guess.