IETF formats for attestation claims (Entity Attestation Token) and for reference values and endorsements (Concise Reference Integrity Manifest).
EAT carries claims about a device or workload in a signed token. CoRIM describes what a verifier should expect: reference measurements and endorsements from manufacturers and software suppliers.
Together they let verifiers compare evidence with reference values without vendor-specific glue for every platform.
Example. A chip maker publishes the expected firmware measurements as a CoRIM. A device reports its actual ones in a token. The verifier compares the two.
Attested software supply chainAttested devices
Working on re-attestation for your product? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.