Bootstrapped TLS Authentication with Proof of Knowledge

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 16
Abstract: This document defines a mechanism that enables a bootstrapping device to establish trust and mutually authenticate against a TLS server. Bootstrapping devices have a public/private key pair; this mechanism enables a TLS server to prove to the device that it knows the public key and enables the device to prove to the TLS server that it knows the private key. The mechanism leverages existing Device Provisioning Profile (DPP) and TLS standards and can be used in an Extensible Authentication Protocol (EAP) exchange with an EAP server.
Publication Date: 2026-05-01
Status Note: Proposed Standard
DOI: 10.17487/RFC9966
Link: https://doi.org/10.17487/RFC9966
Author(s): Owen Friel
Dan Harkins

Latest version of IETF RFC 9966

Document Versions — IETF RFC 9966

▶ IETF RFC 9966 (2026-05-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

NIST.FIPS.186-5 — FIPS186-5 EXTERNAL
IETF RFC 2119 [Active*]
IETF RFC 5480 [Active*]
IETF RFC 5869 [Active*]
IETF RFC 7250 [Active*]
IETF RFC 8174 [Active*]
IETF RFC 8773 [Superseded*]
IETF RFC 9258 [Active*]
IETF RFC 9965 [Active*]

Bibliographic Reference(s)

10.1007-10720107_24 — DUCKLING EXTERNAL
10.1109-IEEESTD.2021.9650828 — IEEE8802.1x EXTERNAL
NIST FIPS 180-4 [Active]
Wi-Fi Alliance, "Wi-Fi Easy Connect(TM) Specification", Version 3.0, 2022, <https://www.wi-fi.org/system/files/Wi-Fi_Easy_Connect_Specification_v3.0.pdf>. EXTERNAL
IETF RFC 3748 [Active*]
IETF RFC 7030 [Active*]
IETF RFC 7542 [Active*]
IETF RFC 9930 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9966.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9966, Bootstrapped TLS Authentication with Proof of Knowledge. Available at https://doi.org/10.17487/RFC9966

Snippet:

IETF RFC 9966, Bootstrapped TLS Authentication with Proof of Knowledge. Available at https://doi.org/10.17487/RFC9966

HTML (ISO 690 compliant)

Preview:

IETF RFC 9966, Bootstrapped TLS Authentication with Proof of Knowledge. Available at https://doi.org/10.17487/RFC9966

Snippet:

<span class="citation"><cite>IETF RFC 9966</cite>, Bootstrapped TLS Authentication with Proof of Knowledge. Available at <a href="https://doi.org/10.17487/RFC9966" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9966</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9966, Bootstrapped TLS Authentication with Proof of Knowledge
doi: 10.17487/RFC9966
url: https://doi.org/10.17487/RFC9966

Snippet:

<li>
<cite id="bib-rfc9966">IETF RFC 9966</cite>, Bootstrapped TLS Authentication with Proof of Knowledge
<span class="doi">10.17487/RFC9966</span>
</li>

Referenced By

IETF RFC 9973 [Active*]