diff --git a/quiche/blind_sign_auth/proto/attest_and_sign.proto b/quiche/blind_sign_auth/proto/attest_and_sign.proto
index c9a9021..a2bae6c 100644
--- a/quiche/blind_sign_auth/proto/attest_and_sign.proto
+++ b/quiche/blind_sign_auth/proto/attest_and_sign.proto
@@ -22,7 +22,7 @@
 option java_package = "com.google.privacy.ppn.proto";
 
 // Client is requesting to auth using the provided auth token.
-// Next ID: 6
+// Next ID: 8
 message AttestAndSignRequest {
 
   // A string uniquely identifying the strategy this client should be
@@ -40,6 +40,22 @@
 
   // Uses IETF privacy pass extensions spec for format.
   bytes public_metadata_extensions = 5;
+
+  // Client-reported device manufacturer (e.g. "Google", "Samsung") for
+  // verification against the TEE-attested AttestationIDManufacturer.
+  // Only set when enable_id_attestation is true.
+  string client_manufacturer = 6;
+
+  // Indicates whether the client is requesting Device ID attestation
+  // verification. When true, the server will extract the manufacturer from the
+  // TEE attestation certificates and compare it with the client_manufacturer
+  // field.
+  //
+  // This is set to true by the client only when:
+  // 1. The client-side rollout flag is enabled.
+  // 2. The device hardware/StrongBox supports ID attestation.
+  // 3. The client is able to retrieve the client manufacturer name.
+  bool enable_id_attestation = 7;
 }
 
 message AttestAndSignResponse {