mirror of
https://github.com/ipxe/ipxe
synced 2026-10-07 15:05:42 +03:00
Michael Brown
35a1abdbf8
The CBC ciphers require a fully unpredictable initialisation vector, which we currently generate as a channel ephemeral secret. The GCM ciphers require only a unique initialisation vector: there is no requirement for it also to be unpredictable. The content of the record IV portion of the IV is a free choice of the sender, and we currently use an unpredictable value for both CBC and GCM. TLS version 1.3 removes the record IV portion for GCM ciphers, instead constructing the IV by XORing the sequence number into the end of the fixed IV. Define the concept of a sequential initialisation vector as meaning that the sequence number is XORed into the end of the overall initialisation vector (which may be either the fixed IV or the record IV portion), with no per-record unpredictable value required. This allows us to represent the mechanism required for TLS version 1.3, and avoid the unnecessary cost of generating a channel ephemeral secret for a GCM cipher under TLS version 1.2. On the receive side, the XORed portion may be overwritten by the real record IV, since the sender's choice is always definitive for the contents of the record IV. Signed-off-by: Michael Brown <mcb30@ipxe.org>
iPXE network bootloader
iPXE is the leading open source network boot firmware. It provides a full PXE implementation enhanced with additional features such as:
-
boot from a web server via HTTP or HTTPS,
-
boot from an iSCSI, FCoE, or AoE SAN,
-
control the boot process with a script,
You can use iPXE to replace the existing PXE ROM on your network card, or you can chainload into iPXE to obtain the features of iPXE without the hassle of reflashing.
iPXE is free, open-source software licensed under the GNU GPL (with some portions under GPL-compatible licences).
You can download the rolling release binaries (built from the latest commit), or use the most recent stable release.
For full documentation, visit the iPXE website.