How a device gets its first identity at the factory and is handed to its owner in the field.
At the factory a device receives a key it can never give away and a certificate from its maker. For a TPM this is the endorsement key certificate. For industrial and network devices it is often a manufacturer identity certificate. For small chips it is a DICE secret.
In the field the device has to find and trust its owner, and the owner has to trust the device. Protocols such as BRSKI and FIDO Device Onboard do this without a technician typing passwords. The device then receives an operational identity from the owner.
Onboarding proves who made the device. It says little about what the device runs a year later. Identity checked once at onboarding is trust on first use with better paperwork, unless the device proves its state again afterwards.
Attested OT and industrial controlAttested devicesAttested robots
Working on re-attestation for your product? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.