mirror of
https://github.com/ipxe/ipxe
synced 2026-10-07 15:05:42 +03:00
Michael Brown
2e549711c2
For TLS version 1.1 (without explicit signature hash algorithm identifiers), we currently use the cipher suite's public key algorithm when verifying the ServerKeyExchange signature. This is indirectly guaranteed to match the server certificate's own public key algorithm. Use the server certificate's own public key algorithm directly, to be consistent with the behaviour for client certificates. The signed certificate is, by definition, the authoritative source for its own choice of public key algorithm. This leaves the public key algorithm aspect of the cipher suite as being unused outside of debug messages. We do not enforce the specification that the certificate's public key algorithm must match the cipher suite's public key algorithm (if any) because doing so serves no cryptographic purpose. For TLS version 1.2 and later, the explicit signature hash algorithm identifiers override the cipher suite, and in TLS version 1.3 the whole concept of a public key algorithm is removed from the scope of the cipher suite. Signed-off-by: Michael Brown <mcb30@ipxe.org>
iPXE network bootloader
iPXE is the leading open source network boot firmware. It provides a full PXE implementation enhanced with additional features such as:
-
boot from a web server via HTTP or HTTPS,
-
boot from an iSCSI, FCoE, or AoE SAN,
-
control the boot process with a script,
You can use iPXE to replace the existing PXE ROM on your network card, or you can chainload into iPXE to obtain the features of iPXE without the hassle of reflashing.
iPXE is free, open-source software licensed under the GNU GPL (with some portions under GPL-compatible licences).
You can download the rolling release binaries (built from the latest commit), or use the most recent stable release.
For full documentation, visit the iPXE website.