Remote attestation and confidential computing · verifiers written from the specifications, proven on real hardware · Austin, Texas
I work on what a signed statement from a machine actually proves — and what it does not — and on the code that checks it: attestation verifiers for AMD SEV-SNP, Intel TDX and NVIDIA H100 confidential GPUs (AWS Nitro Enclaves in review), the services that act on their results, and measurements that show where the specifications leave room.
Vault Genome · Go · AGPL-3.0
Open-source continuity for fine-tuned AI models: the model is sealed as a compact genome, its key is released only to hardware that attests, and the restored model is gated EXACT or EQUIVALENT against its own sealed references. Measured on real chips: a failover from a Google Cloud SEV-SNP host to an Azure confidential H100 in 24.99 s; a 32B model restored and gated EXACT on the H100; byte-identical integer inference on an Intel Xeon and an NVIDIA L4; seven of eight adversarial policies refused on the record. Every number is one of 26 verifiable claims, each with its evidence files and the command that reproduces it. Releases are signed and reproducible, with SLSA provenance.
HATLS · Python · Apache-2.0
Hybrid attested TLS with a continuity mandate: proof that the confidential machine answering you is the same enrolled instance it was at the first message, and detection within one message when it stops being. Measured on AMD SEV-SNP: 2.5 µs per link, about 1 ms per mandate check; no false reject, no accepted impersonation and no accepted relayed exporter in 500 trials each. Hardware results.
geoar-verifier · Shell, Python
A verifier for geographic attestation results and a measured atlas of where a place enters an attestation artifact: AWS Nitro and SEV-SNP with VLEK, Google Cloud SEV-SNP and Intel TDX, Azure SEV-SNP through the paravisor. Every signature checked against the vendor root with independent code, every capture tied to a public nonce. Start with ATLAS.md.
tacra-est · Python, ProVerif
Reference implementation, twenty-four ProVerif models and SEV-SNP measurements for the EST profile of TACRA (draft-novak-lamps-tacra-est): the attacks the first text admits, and the bindings that close them.
- Co-author of draft-richardson-rats-geographic-results, geographic attestation results in the RATS working group; author of the
basisproposal — a location claim states which class of artifact it rests on (pull requests). - draft-nikolaichuk-rats-tap: attestation-gated release of sealed key material, recorded as an auditable object.
- draft-nikolaichuk-scitt-continuity-receipts: the recovery of a stateful asset registered as a signed statement in a transparency service.
- Measurements for the SEAT working group, filed in its trackers: the early-attestation binder after a HelloRetryRequest (#74) and what a "machine identifier" is on three platforms (use-cases #8).
GlossPlate, a production menu platform for restaurants (web and Android; Square and Clover point-of-sale integrations end to end), and Entropy Protocol, provenance for AI-generated text. Named inventor on eight USPTO patent applications, drafted and prosecuted myself. Retrieval for AI agents with XERJ: aiburnclock.org, xerj-plugins, xerj-offline.