Binary attestation reports exact hashes of software. Property-based attestation reports what the software is certified to do.
Binary attestation says: this exact code is running. It is precise and easy to produce. It is also brittle. Every patch changes the hash, and the verifier needs a list of every acceptable version.
Property-based attestation says: this system has a property, for example 'runs a firewall approved by the operator'. A trusted party maps binaries to properties. Verifiers stay stable while software changes, and less is revealed about the exact configuration.
In practice, products use both. The device reports hashes. A verifier turns them into a statement such as 'approved release, security version 12', and relying parties act on that statement. The mapping is where re-attestation policy lives.
Continuous complianceAttested software supply chain
Working on re-attestation for your product? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.