AMD EPYC Venice - New CPU Version, New Confidential Computing Features

In July of 2026 AMD announced their new generation of EPYC server CPUs codenamed Venice at their Advancing AI 2026 event. Among the announced features were various security improvements, such as PQC support, additional side channel mitigations and changes to the confidential computing world of AMD, namely SEV-SNP.

‍

With the newest version of the AMD SEV specification (1.59), which just has been released we now get a preview on upcoming changes and features for Venice and older CPU generations.

‍

Changing the root of trust

‍

Since the first release of AMD EPYC and SEV, AMD has relied on the Versioned Chip Endorsement Key (VCEK) for securing the root of trust. The VCEK is an ECDSA key which is backed through a certificate chain issued by AMD. With this new release AMD introduces the Chip-Secret VCEK (CSVCEK). Both keys are backed through an AMD signed and issued certificate chain, however in order to verify the CSVCEK a verifier no longer needs to contact AMD each time he wants to verify the key. Instead the verifier retrieves a certificate chain once per CPU family and afterwards can verify any CPU of that family. The CSVCEK is rooted through a certificate chain of different TCB components which all hierarchically sign the next component in the TCB chain, if it is considered trustworthy.
‍

With this change comes also the switch from AMD to the Device Identifier Composition Engine (DICE) framework for the certificate chain. Additionally AMD standardizes the On-Chip certificate chain by using the Caliptra Framework of the CHIPS Alliance and Open Compute Project. AMD currently deploys Caliptra 1.x within their Venice CPUs, which allows for  a retrofit of ML-DSA-87 through a firmware implementation, while Caliptra 2.0 uses hardware acceleration for these tasks. However as of now the specification from AMD still relies on ECDSA for the CSVCEK.

‍

Attesting the host and guest together

‍

With the change of the VCEK to the CSVCEK, AMD prepares for future regulations and standardization across the entire ecosystem while improving the security of their confidential computing solution. As part of this effort AMD introduces the binding of TPM measurements from the host to a guest attestation report. This allows the guest to verify the boot chain and other components of the underlying host operating system through standardized mechanisms. Such a binding of the host attestation to the guest attestation is required in regulated environments, such as healthcare. A prime example of this requirement is the upcoming Healthcare Confidential Computing (HCC) of gematik, which is Germanys national agency for digital medicin.

‍

Each TPM is therefore equipped with an Endorsement Key which is used to uniquely identify the TPM and to validate the authenticity of quotes issued by the TPM. This unique identifier is used by AMDs Security Processor to calculate a fingerprint of the public key component during the platform boot, before the general purpose compute is started. During the boot phase the existing Trusted Platform Boot features are utilized for authentication and measurement of the x86 boot chain. Once the boot process is complete and the host operating system is reached, the PCRs of the TPM have been extended with all measurements and configurations of the platform TCB. At this point any software can request a TPM quote which generates evidence over the stored PCR values and is authenticated using the Endorsement Key.

‍

Once the cVM requests an attestation report the AMD Security Processor will bind the unique identifier of the attestation report, the fingerprint of the attestation report and a nonce to the TPM by signing this information through the VCEK/VLEK or if used through the CSVCEK. As part of the attestation request, the guest receives the normal SEV-SNP attestation report, TPM binding object, TPM quote and certificates which are necessary for verifying the attestation chain. By verifying the attestation report and TPM quote the cVM learns if the cVM and host operating system are configured correctly. By verifying the signature of the TPM binding object and the contained information against the TPM quote and attestation report, the cVM learns if the TPM quote actually belongs to the current host operating system or a different system.
‍

Summary
‍

AMDs new specification 1.59 for SEV-SNP brings a lot of new features into the confidential computing world. The two most interesting features of this release are the Chip-Secret VCEK and the TPM binding. By leveraging the Chip-Secret VCEK AMD prepares the path for future CNSA 2.0 compliance and moves to an open industry standard with a clear roadmap and requirements for any Root of Trust. This enables consumers to interact with standardized endpoints and formats which, following wider adoption, allows for the generalization of the confidential computing industry. Through TPM binding AMD solves a long standing problem for regulated industries, which is to ensure that cVMs only run on preapproved hardware in preapproved locations.

‍