Summary

  • RFC 9966’s TLS-POK lets a device and a TLS server prove complementary knowledge of a Bootstrap Key, so that a device can receive a credential for later EAP authentication.
  • The proof begins only after the server has acquired the public key by a mechanism the RFC leaves outside scope; it cannot by itself establish rightful possession, key custody, network authorization or a completed access outcome.

Dan Harkins and Owen Friel’s RFC 9966 begins with a familiar loop in device onboarding. A network expects an EAP credential before it will provide access, but an unprovisioned device needs some network path in order to obtain a credential. The document’s answer, TLS Proof of Knowledge or TLS-POK, is deliberately concrete: use a device’s elliptic-curve Bootstrap Key, or BSK, to run a TLS 1.3 exchange in which each side can demonstrate something the other needs to see.

The BSK is a public/private pair. The device retains the private half. Its public half is known to the device and its owner or holder, then provisioned on the TLS server by the server operator. In the resulting handshake, the server demonstrates knowledge of the device’s BSK public key; the device demonstrates possession of the matching private key. The EPSK used in the TLS exchange is derived from the public key, and the client later authenticates with the BSK as a raw public key.

That is a useful proof, but it begins after a more difficult act has already occurred. RFC 9966 explicitly leaves the way in which the server acquired the public key outside its scope. It offers a QR-label scan and a bill-of-materials upload as examples, then states the physical-possession assumption plainly: if the label is attached to the device, possession is treated as legitimate ownership. The protocol receives that association as an input. It does not audit the manufacturer’s record, the supply chain, the handover, the label scan, the BOM, the buyer, or the local authorization decision.

The security section describes why this distinction is not philosophical. The client is meant to rely on the BSK public key being non-public. An adversary who learns it and can draw the client to a hostile server may complete the TLS-POK exchange and cause the client to bootstrap against that network. A different failure comes earlier: substitute a rogue device’s public key during the bootstrap method and the legitimate server can onboard the rogue device. In both cases, the TLS transcript can faithfully prove knowledge of the material it was given. It cannot prove that the material was acquired under the right custody conditions.

The implementation details reinforce the bounded design. The client must process ServerHello and verify the TLS key schedule before it discloses its BSK public key. If PSK verification fails, it must end the handshake without revealing it. Manufacturers should use a distinct BSK for every device; if several devices share one, an operator cannot distinguish them or ensure that only particular authorized devices connect. Those rules reduce identifiable failure modes. They do not convert a QR label into title, a server database into an inventory ledger, or proof of possession into a standing right of admission.

After a successful bootstrap, the server can provision a credential for later EAP authentication. The BSK is not that later credential: RFC 9966 says it is used only during bootstrap. This is the article’s operational point. A completed exchange can be evidence of a particular key relationship and of the conditions the protocol checks. It is not, without separate records, evidence that the device is rightful, that an operator approved it, that a credential was issued, or that a policy engine subsequently admitted it.

Harkins’s public IETF profile links him to this co-authored RFC, and an IEEE 802.11 recognition photograph grounds the person-specific portrait. Neither source turns one engineer into the owner of all resulting systems. The durable contribution is the sharper boundary in the standard: make an initial proof usable, but refuse to pretend that its missing custody chain has been solved by a successful handshake.

Sources