Token Secure Boot Attestation

Secure Boot Attestation verifies that the device firmware and boot process are authentic and have not been tampered with. This step ensures that the device itself is in a trustworthy state.

Why it matters:

• Prevents compromised firmware from interacting with the system.

• Confirms device integrity before performing sensitive operations.

How it works

1. Request Secure Boot Challenge Word (BootCW).

2. Compute and submit the Host Response Word (HRW).

3. Check attestation status — only proceed if AUTH_OK.

Prerequisites

• Client must be authenticated.

• Valid CF-Access-Client-ID and CF-Access-Client-Secret are required.

• Devices must be ordered correctly in the chain. 

End-to-End Flow

1. Client requests Boot Challenge Word (BootCW)

2. Devices compute the Host Response Word (HRW)

3. Client submits Secure Boot RW

4. Service validates the attestation

5. Client polls status API until final result