paint-brush
Glossary of Security Terms: TOFUby@mozilla
195 reads

Glossary of Security Terms: TOFU

by Mozilla ContributorsSeptember 14th, 2020
Read on Terminal Reader
Read this story w/o Javascript
tldt arrow

Too Long; Didn't Read

Trust On First Use (TOFU) is a security model in which a client needs to create a trust relationship with an unknown server. To do that, clients will look for identifiers (for example public keys) stored locally. If an identifieris found, the client can establish the connection. If no identifier is found, a client can prompt the user to determine if the client should trust the identifier. TOFU is used in the SSH protocol, in HTTP Public Key Pinning (HPKP) and in HSTS.

Company Mentioned

Mention Thumbnail
featured image - Glossary of Security Terms: TOFU
Mozilla Contributors HackerNoon profile picture

Trust On First Use (TOFU) is a security model in which a client needs to create a trust relationship with an unknown server. To do that, clients will look for identifiers (for example public keys) stored locally. If an identifier
is found, the client can establish the connection. If no identifier is found, the client can prompt the user to determine if the client should trust the identifier.

TOFU is used in the SSH protocol, in HTTP Public Key Pinning (HPKP) where the browsers will accept the first public key returned by the server, and in

Strict-Transport-Security
 (HSTS) where a browser will obey the redirection rule.

Learn more

View Previous Terms: