wolfSSL is adding PSA Initial Attestation API 2.0 and RFC 9783 PSA Entity Attestation Token (EAT) support to wolfCOSE. This lets a device prove its identity, security lifecycle state, and boot measurements to a relying party using the compact COSE/CBOR formats already used across the IoT ecosystem. Consistent with wolfCOSE’s design, PSA/EAT is fully off by default, and no PSA/EAT symbols or parser code are emitted unless enabled.
The feature set includes:
- PSA Initial Attestation API 2.0 and RFC 9783 EAT token issue and consume
- Ten independently selectable gates: profile, consume, issue, envelope, legacy, and helper paths
- Reuse of existing fine-grained ES256/384/512, HMAC256/384/512, Sign1, Mac0, encode, and decode gates
- Demos, a lean verify-only example, and a test matrix across curves, hashes, and key-size gates
RFC 9783 claims remain atomic, since compiling mandatory profile behavior out would be noncompliant.
For additional information regarding this feature, interested parties may contact wolfSSL at facts@wolfssl.com or call +1 425 245 8247. See the PR #75.
Download wolfSSL Now