# TPM2 P256/SHA256 Quote Attestation PCR-Nonce Signature Binding Verifier

> TPM2 P256/SHA256 Quote Attestation PCR-Nonce Signature Binding Verifier is a paid API for AI agents from detect.halowerk.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-11-04).

Verifies a TPM2 quote signature over selected PCRs and a nonce, reconstructs the typed attestation structure, and compares its canonical SHA256 claim hash.

## Facts

- Endpoint: POST https://detect.halowerk.com/v1/F-TD2000-DOCUMENTS-12/tpm20-p256-sha256-quote-attestation-pcr-nonce-signature-binding?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-04
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tpm2-p256-sha256-quote-attestation-pcr-nonce-signature-binding-verifier-bce11296
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_HCCtQF-_Uzu37kGN5yzDx

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tpm2-p256-sha256-quote-attestation-pcr-nonce-signature-binding-verifier-bce11296 -d '<json body>'
```

Example prompt: Verify this TPM2 P256/SHA256 quote attestation for me: I have the attestation hex, the signer's public key in PEM format, the DER signature hex, the expected nonce hex, the expected qualified signer hex, and PCR values for indices 0 through 7 — please reconstruct the typed quote structure, check the nonce and PCR bindings, and confirm the canonical SHA256 claim matches.

## When to prefer this

Use this endpoint when you need cryptographic verification of a TPM2 quote produced using ECDSA P256 with SHA256, including both signature validity and PCR-nonce binding checks with canonical claim comparison. Prefer it over generic signature verification services when you specifically need TPM2 TPMS_ATTEST structure reconstruction and PCR binding semantics.

## Known failure modes

- Invalid or malformed attestation_hex returns a parse/deserialization error
- Signature verification failure if public key does not match signing key
- Nonce mismatch if expected_nonce_hex does not match the nonce embedded in the quote
- PCR value mismatch if supplied PCR values do not match those in the quote
- SHA256 claim mismatch if the canonical reconstruction does not match the provided claim
- Malformed PEM public key causes key-loading failure
- DER signature hex in wrong format returns signature parse error

## How this service works

Verify supplied TPM2 quote signature and complete selected-PCR nonce signer bindings. Reconstruct the fully typed result and compare its complete canonical SHA256 claim.

## Output

Returns a structured result indicating whether the TPM2 P256/SHA256 quote signature is valid, whether the PCR-nonce bindings match the supplied expected values, and whether the reconstructed canonical SHA256 claim matches the provided claim hash.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "artifact": {
   "type": "object",
   "$defs": {
    "s0": {
     "type": "string",
     "pattern": "^[0-9a-f]{64}$",
     "maxLength": 64,
     "minLength": 64
    }
   },
   "required": [
    "tpmQuote"
   ],
   "properties": {
    "tpmQuote": {
     "type": "object",
     "required": [
      "data",
      "claim"
     ],
     "properties": {
      "data": {
       "type": "object",
       "required": [
        "attestation_hex",
        "public_key_pem",
        "signature_der_hex",
        "expected_nonce_hex",
        "expected_qualified_signer_hex",
        "pcr_values"
       ],
       "properties": {
        "pcr_values": {
         "type": "array",
         "items": {
          "type": "object",
          "required": [
           "index",
           "value_hex"
          ],
          "properties": {
           "index": {
            "type": "integer",
            "maximum": 23,
            "minimum": 0
           },
           "value_hex": {
            "$ref": "#/properties/input/properties/body/properties/artifact/%24defs/s0"
           }
          },
          "additionalProperties": false
         },
         "maxItems": 24,
         "minItems": 0
        },
        "public_key_pem": {
         "type": "string",
         "maxLength": 512,
         "minLength": 1
        },
        "attestation_hex": {
         "type": "string",
         "pattern": "^(?:[0-9a-f]{2})*$",
         "maxLength": 4096,
         "minLength": 0
        },
        "signature_der_hex": {
         "type": "string",
         "pattern": "^(?:[0-9a-f]{2})*$",
         "maxLength": 160,
         "minLength": 0
        },
        "expected_nonce_hex": {
         "type": "string",
         "pattern": "^(?:[0-9a-f]{2})*$",
         "maxLength": 128,
         "minLength": 0
        },
        "expected_qualified_signer_hex": {
         "type": "string",
         "pattern": "^(?:[0-9a-f]{2})*$",
         "maxLength": 136,
         "minLength": 0
        }
       },
       "additionalProperties": false
      },
      "claim": {
       "anyOf": [
        {
         "type": "null"
        },
        {
         "$ref": "#/properties/input/properties/body/properties/artifact/%24defs/s0"
        }
       ]
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tpm2-p256-sha256-quote-attestation-pcr-nonce-signature-binding-verifier-bce11296/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from detect.halowerk.com](https://www.zero.xyz/host/detect.halowerk.com/llms.txt)