dcap-qvl

Verify Intel SGX and TDX attestation quotes. dcap-qvl is a small, pure-Rust library that verifies DCAP (Data Center Attestation Primitives) quotes, with native bindings for Python, Go, Kotlin, and Swift — plus a standalone pure-JavaScript implementation for the web.

What it does

• Verifies SGX and TDX quotes against Intel's trust chain.
• Gets collateral for you from a PCCS or Intel PCS — or verifies fully offline with collateral you already have.
• Extracts report fields from a quote: measurements, report data, TCB status, and advisory IDs.
• Runs everywhere. The pure-Rust core works on servers, mobile, WebAssembly, and on-chain (no_std).

By default it uses Phala Network's PCCS (https://pccs.phala.network) for better availability and lower rate limits.

Languages

Language	Package	Install	Guide
Rust	dcap-qvl	cargo add dcap-qvl	docs.rs
Python	dcap-qvl	pip install dcap-qvl	python-bindings/
JavaScript (pure JS)	@phala/dcap-qvl	npm i @phala/dcap-qvl	dcap-qvl-js/
Go	github.com/Phala-Network/dcap-qvl/golang-bindings	go get github.com/Phala-Network/dcap-qvl/golang-bindings	golang-bindings/
Android (Kotlin/Java)	com.phala:dcap-qvl-android	Gradle	dcap-qvl-mobile/android/
Swift (iOS/macOS)	dcap-qvl-swift	SwiftPM	dcap-qvl-mobile/ios/

The JavaScript package is a standalone pure-JS port that runs in Node and the browser with no native dependencies. WebAssembly builds of the Rust core are also published as @phala/dcap-qvl-web and @phala/dcap-qvl-node.

There's also a command-line tool, dcap-qvl-cli (cargo install dcap-qvl-cli).

How verification works

To verify a quote you need three things:

1. the quote bytes,
2. the collateral for it — the certificates, CRLs, and TCB info that prove the quote against Intel's trust chain, served by a PCCS, and
3. the current time, to check the collateral hasn't expired.

verify() checks the signature chain and TCB status and returns the report plus a status string. If you don't already have collateral, the library can fetch it from a PCCS for you in one step.

Quick start

Rust

use dcap_qvl::collateral::CollateralClient;
use dcap_qvl::verify::verify;
use dcap_qvl::PHALA_PCCS_URL;

let quote = std::fs::read("quote.bin")?;
let collateral = CollateralClient::with_default_http(PHALA_PCCS_URL)?
    .fetch(&quote)
    .await?;
let now = std::time::SystemTime::now()
    .duration_since(std::time::UNIX_EPOCH)?
    .as_secs();
let report = verify(&quote, &collateral, now)?;
println!("status = {}", report.status);

See the docs.rs page for crypto-backend selection, feature flags, no_std, and offline verification.

Python

import asyncio, dcap_qvl

async def main():
    quote = open("quote.bin", "rb").read()
    result = await dcap_qvl.get_collateral_and_verify(quote)  # defaults to Phala PCCS
    print(result.status)

asyncio.run(main())

JavaScript

import { getCollateralAndVerify } from '@phala/dcap-qvl';

const result = await getCollateralAndVerify(quoteBuffer); // defaults to Phala PCCS
console.log(result.status);

Android (Kotlin)

import com.phala.dcapqvl.*

// collateralJson is the raw PCCS response body — fetch it with OkHttp / Ktor.
val report = verify(rawQuote, collateralJson, nowSecs)
println(report.status)

Swift

import DcapQvl

let report = try verify(rawQuote: rawQuote, collateralJson: collateralJson, nowSecs: nowSecs)
print(report.status)

Go

import dcap "github.com/Phala-Network/dcap-qvl/golang-bindings"

report, _ := dcap.GetCollateralAndVerify(rawQuote, dcap.PhalaPCCSURL)
fmt.Println(report.Status)

Each binding's directory (linked in the table above) has full documentation and runnable examples.

Building and testing

Common tasks are in the Makefile:

cargo test              # test the Rust core
make build_python       # build + test the Python bindings
make test_wasm          # test the WASM packages
make build_mobile_android  # build the Android AAR
make build_mobile_ios      # build the iOS XCFramework (macOS only)

Releasing

A single v<X.Y.Z> tag publishes every ecosystem at one version — crates.io, PyPI, npm, Maven Central, and the Swift Package Index. See dcap-qvl-mobile/RELEASING.md.

License

MIT — see LICENSE.