RE: iSCSI and secure boot

[Bernard Aboba <aboba@internaut.com>]

> Can you describe a secure diskless boot that does not require individual
> setup of each?  

Some touching of each PC is required. However, the question is whether:

a. The setup requires setup of multiple credentials, or just
one. Note that BIS requires each PC to be configured with certificate of
the boot image signing authority. However, this does not provide client
authentication capabilities - so if you want to authenticate iSCSI or
DHCP, or anything else, then you'd need additional credentials.

b. Whether *per-interface* credentials are needed (e.g. authenticated DHCP
draft -16), or *per-machine*. Per-interface credentials require the
machine to be touched every time an interface is added or removed, not
just when the machine is shipped by the OEM.