mirror of
https://github.com/ipxe/ipxe
synced 2026-10-07 15:05:42 +03:00
Michael Brown
c2e9bd951a
The format of the signature found within a CertificateVerify is identical to the format of the signature within a ServerKeyExchange. Abstract out the logic for verifying a ServerKeyExchange and use it to verify the signature for both ServerKeyExchange and CertificateVerify. Note that a CertificateVerify that is erroneously received under TLS version 1.2 will always fail verification because the key schedule is not able to generate a signable digest for the server endpoint. A ServerKeyExchange that is erroneously received under TLS version 1.3 will fail validation because the TLS version 1.3 cipher suites provide no way to parse the ServerKeyExchange parameters. (An interestingly deviant server that chooses to negotiate TLS version 1.3 with a TLS version 1.2 cipher suite would be able to send a ServerKeyExchange with a valid signature and have that key contribute accumulatively to the key schedule: this would not conform to the protocol, but does not actually weaken any of the security properties required to establish the secure channel.) Signed-off-by: Michael Brown <mcb30@ipxe.org>
iPXE network bootloader
iPXE is the leading open source network boot firmware. It provides a full PXE implementation enhanced with additional features such as:
-
boot from a web server via HTTP or HTTPS,
-
boot from an iSCSI, FCoE, or AoE SAN,
-
control the boot process with a script,
You can use iPXE to replace the existing PXE ROM on your network card, or you can chainload into iPXE to obtain the features of iPXE without the hassle of reflashing.
iPXE is free, open-source software licensed under the GNU GPL (with some portions under GPL-compatible licences).
You can download the rolling release binaries (built from the latest commit), or use the most recent stable release.
For full documentation, visit the iPXE website.