Bootstrapped TLS Authentication with Proof of Knowledge
RFC 9966, “Bootstrapped TLS Authentication with Proof of Knowledge”, is a Proposed Standard document published in May 2026 by O. Friel, D. Harkins. The canonical text is published by the RFC Editor.
Abstract
This document defines a mechanism that enables a bootstrapping device to establish trust and mutually authenticate against a TLS server. Bootstrapping devices have a public/private key pair; this mechanism enables a TLS server to prove to the device that it knows the public key and enables the device to prove to the TLS server that it knows the private key. The mechanism leverages existing Device Provisioning Profile (DPP) and TLS standards and can be used in an Extensible Authentication Protocol (EAP) exchange with an EAP server.
What “Proposed Standard” means
An entry-level standards-track specification: stable, peer-reviewed and a solid basis for implementation, though it may still evolve before becoming an Internet Standard.
The canonical text of RFC 9966 is hosted at rfc-editor.org. Available in HTML,TXT,PDF,XML.
- RFC 9965 The eap.arpa
- RFC 9967 System for Cross-Domain Identity Management Profile for Security Event Tokens
- RFC 9964 ML-DSA for JSON Object Signing and Encryption and CBOR Object Signing and Encryption
- RFC 9968 Report from the IAB Workshop on the Next Era of Network Management Operations
- RFC 9963 Legacy RSASSA-PKCS1-v1_5 Code Points for TLS 1.3
- RFC 9969 Report from the IAB Workshop on AI-CONTROL
- RFC 9962 A Decentralized Locator/ID Separation Protocol Mapping System
- RFC 9961 MPLS Segment Routing Point-to-Multipoint Policy Ping