bootseed
Registry Context
The `bootseed` claim identifies a particular boot session of an entity.
Technical Summary
In a JSON-encoded EAT, `bootseed` contains base64url-encoded binary data created at system boot time, allowing attestation reports from different boot sessions of the same entity to be distinguished.
When Used
Used in Entity Attestation Tokens when reports from different boot sessions of a particular entity need to be distinguished.
Normative Requirements
Implementations
RFC 9711 - Section 4.2.13
use the `bootseed` value for any purpose requiring a secret seed, such as seeding a random number generator.
Condition: when processing or using the `bootseed` claim
It is not a secret and MUST NOT be used for any purpose where a secret seed is needed, such as seeding a random number generator.
RFC 7519 - Section 4
ignore claims they do not understand.
Condition: in the absence of application-specific requirements for those claims
in the absence of such requirements, all claims that are not understood by implementations MUST be ignored.
Unspecified actor
RFC 7519 - Section 4
ensure Claim Names within a JWT Claims Set are unique.
Condition: when constructing a JWT Claims Set containing `bootseed`
The Claim Names within a JWT Claims Set MUST be unique.
EAT implementations
RFC 9711 - Section 9.3
provide a freshness mechanism.
Condition: for all EAT use
All EAT use MUST provide a freshness mechanism to prevent replay and related attacks.
JWT parsers
RFC 7519 - Section 4
either reject JWTs with duplicate Claim Names or use a JSON parser that returns only the lexically last duplicate member name.
Condition: when parsing a JWT Claims Set
JWT parsers MUST either reject JWTs with duplicate Claim Names or use a JSON parser that returns only the lexically last duplicate member name.
Validation Guidance
Reject a JWT Claims Set containing multiple `bootseed` members, unless the parser follows RFC 7519 by retaining only the lexically last duplicate member.
Verify that a JSON-encoded `bootseed` value is a base64url text string representing binary data.
Do not use `bootseed` as cryptographic secret material or as a random-number-generator seed.
If `bootseed` is unsupported and no application-specific rule requires it, ignore the claim rather than failing solely because it is unrecognized.
Do not treat `bootseed` alone as satisfying the EAT freshness requirement; verify that the EAT use provides an appropriate freshness mechanism.
Security Notes
RFC 9711 - Section 4.2.13
The `bootseed` value is usually public and is not a secret; using it where secret seed material is required can undermine security.
RFC 9711 - Section 8.3
Because `bootseed` is a stable entity identifier within a boot epoch, it is unsuitable for privacy-preserving attestation schemes.
Reference
Details
- Entry Id
bootseed- Claim Name
bootseed- Claim Description
Identifies a boot cycle- Change Controller
IETF- Reference
RFC9711