A model where a system is trusted the first time it appears, and that first trust is remembered instead of proved again.
TOFU is simple to deploy and fragile to run. If a TOFU node loses its state, it cannot prove itself again; someone has to delete its old record and enrol it as if new. If an attacker gets there first, the first use was theirs.
In SPIRE, join tokens are a classic TOFU method. Hardware- or platform-backed methods let a node re-attest instead.
Example. A new sensor joins with a token typed in by a technician. From then on the network remembers it. If someone copies the sensor's memory, the copy is trusted too.
Attested cloud workloadsAttested AI agents
Working on re-attestation for your product? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.