Device Attestation
Device attestation proves the device hardware and software state to a remote verifier, tying a cryptographic key to a measured boot chain so the verifier can refuse to trust a compromised or.
Definition
Device attestation is a protocol where the device hardware signs a challenge using a key certified by the manufacturer and bound to measured boot values, so a remote verifier can confirm the device is a genuine model running a measured software state before granting access to protected resources.
Context and scope
Applied in enterprise device management, conditional access, and confidential computing where access decisions depend on device trustworthiness, not just user identity.
Common misconceptions
- Device attestation proves the device is managed — it proves the device is in a measured state; managed and trustworthy are not the same
- TPM attestation is tamper-proof — the TPM is tamper-resistant; physical attacks and firmware vulnerabilities have demonstrated bypasses
Anti-patterns
- Attesting boot measurements but not runtime state, trusting a device that boots clean then runs compromised software
- Accepting any device with a valid manufacturer certificate, ignoring whether the measured state matches policy
Related concepts
Authoritative source
https://trustedcomputinggroup.org/resource/tpm-library-specification/
What it is
Device attestation is a protocol where the device hardware signs a challenge using a key certified by the manufacturer and bound to measured boot values, so a remote verifier can confirm the device is a genuine model running a measured software state before granting access to protected resources. Applied in enterprise device management, conditional access, and confidential computing where access decisions depend on device trustworthiness, not just user identity. The threat model determines which controls apply: preventive controls block exploits, detective controls surface violations, and corrective controls restore integrity after an incident.
How it works
Effective implementations layer controls so that no single bypass compromises the asset. Verification happens at trust boundaries, not just at the perimeter. Cryptographic primitives are selected for the concrete property needed — unforgeability, indistinguishability, or non-malleability — and never composed ad hoc. Failure modes fail closed: a verification error denies rather than allows.
When to enforce and pitfalls
Enforce wherever an attacker can influence input that crosses a trust boundary. Common pitfalls include treating obfuscation as a control, relying on secrecy of the algorithm rather than the key, and auditing the happy path while ignoring error-handling branches where bypasses often hide. Rate-limit and log every verification attempt so brute-force and oracle attacks become visible.