RE: iSCSI and secure boot

[Bernard Aboba <aboba@internaut.com>]

> If the results are confirmed, then the process is confirmed.  There should
> be no need to validate every step in the process, just the last step as done
> with PXE 2.  As far as TFTP, it lives up to its name.  A simple TFTP stack
> can be done in a few dozen lines of code.  It is really a minimum amount of
> effort.

Problem with PXE 2 is that it requires touching every PC (to install
the boot image cert) and so isn't widely implemented. Also, if
implemented doesn't support basic capabilities such as revocation. So most
PCs implementing PXE are doing PXE 1 or PXE 2 with no boot image cert
installed. Therefore for all practical purposes PXE = no security.