RFC 9966 - Bootstrapped TLS Authentication with Proof of Knowledge

• Status: Proposed Standard
• Published: May 2026
• Stream: IETF

Abstract

RFC 9966 defines TLS Proof of Knowledge (TLS-POK), a mechanism that lets a bootstrapping device and a TLS server mutually authenticate when the device has an elliptic-curve Bootstrap Key (BSK). The server proves knowledge of the BSK public key through an External Pre-Shared Key (EPSK), and the device proves possession of the BSK private key through raw-public-key ECDSA authentication.

Contents

• 1. Introduction
• 2. Bootstrap Key
• 3. TLS 1.3
• 4. EAP
• 5. IANA
• 6. Implementation
• 7. Security
• 8. References
• Appendix A
• Authors' Addresses