Secure boot ensures a device only runs signed code; attestation lets someone else check that it did. During boot, each stage measures the next and records the hash in a protected register inside a TPM or equivalent. On request, the device signs those measurements with a key bound to its root of trust and sends them to a verifier, which compares them with known-good values before granting access or trusting the device’s data.
Attestation underpins zero trust for devices: identity proves which device is connecting, attestation proves what software it is running. The IETF’s RATS architecture standardizes the roles involved. The practical obstacle is maintaining the reference values for every firmware version in the field, which ties attestation closely to release management.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.