Reattestable
Able to be attested again: to prove its identity or integrity anew after a reset, an expiry or a change.
The vocabulary of attested products, in plain words.
Able to be attested again: to prove its identity or integrity anew after a reset, an expiry or a change.
A way for a machine to prove to a remote party what hardware and software it is running, using evidence signed by a hardware root of trust.
Proving trust again after an event that made the previous proof stale: an update, a reboot, a lost state, an expired credential or a revocation.
Repeating attestation on a schedule during normal operation, so that drift, tampering or compromise is caught while the system runs.
Re-attestation restores trust after an event. Continuous attestation keeps checking during normal operation. Most products need both.
A model where a system is trusted the first time it appears, and that first trust is remembered instead of proved again.
How recent the evidence is, and how a verifier knows it was not replayed.
The IETF Remote ATtestation procedureS architecture (RFC 9334): the shared vocabulary of attesters, verifiers, relying parties, evidence and reference values.
IETF formats for attestation claims (Entity Attestation Token) and for reference values and endorsements (Concise Reference Integrity Manifest).
Hardware-isolated execution that protects code and data in use, and can prove what it runs through attestation.
Running AI training or inference inside TEEs, so prompts, data and model weights stay protected in use, and clients can verify the service by attestation.
Proof that a GPU is genuine, runs approved firmware and is in confidential computing mode, before it receives data.
Tying attestation to a TLS connection, so the client knows that the machine it verified is the machine on the other end.
Short-lived, automatically issued identities for software workloads, based on attested properties instead of shared secrets.
Recording a hash of each boot component into a hardware register, so the boot chain can be reported and verified later.
The Trusted Platform Module: a standard hardware root of trust that stores keys and boot measurements and signs quotes for attestation.
Device Identifier Composition Engine: a Trusted Computing Group standard that gives small devices an identity derived from their firmware.
Checking that a system stays in its approved state the whole time it runs.
Signed statements about how software was built (provenance), used to decide what a verifier should accept at runtime.
Evaluating systems against compliance rules all the time, with automated evidence, instead of preparing once a year for an audit.
In the EU Digital Identity Wallet, the wallet provider's signed statement that a wallet unit is genuine and that its keys are held in suitable secure hardware.
In eIDAS 2.0, an 'electronic attestation of attributes' is a credential about a person. A wallet or key attestation is evidence about a device. They are different things.
The international standard series for the security of industrial automation and control systems, used in tenders for robots, machines and industrial devices.
The process after a flaw in a trusted execution environment: the vendor ships a fix, raises the security version, and verifiers stop accepting evidence from unpatched platforms.
A set of signed, checkable statements about an AI model or agent: its origin, lineage, build, runtime, configuration, principal and validity.
Computing whose hardware and software state can be proved to a remote party with evidence rooted in hardware. It promises integrity, not secrecy.
An isolated machine, often a microVM, started for one AI agent so it can run code, browse and keep files without touching anything else.
The software identification number of UN Regulation 156: an identifier, defined by the vehicle manufacturer, for the software relevant to a type approval.
Each platform has its own word for attestation evidence. A report is often local, a quote is signed for remote use, and a token usually carries a verifier's result.
One protected environment proving itself to another on the same machine, without any outside service.
Binary attestation reports exact hashes of software. Property-based attestation reports what the software is certified to do.
Making systems on different hardware, such as Intel, AMD, Arm and NVIDIA, verify each other.
Every vendor has its own word for an isolated environment that can be attested. Some protect part of a program, some a whole virtual machine.
A layer that lets an ordinary application run inside an enclave without being rewritten.
How a device gets its first identity at the factory and is handed to its owner in the field.
A model in which people, organisations and devices hold their own identifiers and credentials, and present them without asking the issuer each time.
Secure boot, a hardware key and a certificate sound basic. On a low-cost device, made in someone else's factory and installed in the field, each one is hard.
Where attestation belongs in each stage of a secure development life cycle, from design to retirement.
The property that someone who signed or sent something cannot later credibly deny it.
Ways for a device to prove it is genuine without revealing which device it is.
Evidence that a piece of work was produced by a person with a particular tool, recorded while it was made.