Trust on first use · WebGlossary.info

A security model used by client software which needs to establish a trust relationship with an unknown or not-yet-trusted endpoint. In a TOFU model, the client will try to look up the endpoint’s identifier, usually some kind of public key, in its local trust database. If no identifier exists yet for the endpoint, the client software will either prompt the user to determine if the client should trust the identifier, or it will trust the identifier which was given and record the trust relationship into its trust database. If a different identifier is received in subsequent connections to the endpoint the client software will consider it to be untrusted. The TOFU approach can be used when connecting to arbitrary or unknown endpoints which do not have a trusted third party, such as a certificate authority. ← Wikipedia