-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Thu, 29 May 2008, Fred Reimer wrote:
plaintext (the IOS code) and the hash. It is not trivial to be able to make changes in the code and maintain the same hash value, but there has been at least limited success in doing so.
Has there? My understanding is that constructing a new image to match an existing MD5 checksum (vs. constructing two new images with matching MD5 checksums) was still not feasible. Did I miss something?
It may not be possible to replace the boot ROM, because presumably the new hardware would check the ROM code hash before loading it and also presumably the ROM code does not have quite as much text messages that can be changed to generate the same hash value, thereby bypassing the security checks.
This may be an obvious question, but given that the code which verifies an IOS image would (presumably) be part of the boot ROM, where would you put the code which verifies the boot ROM? What does it mean to say `the hardware' should check the boot ROM? - -- Jim Wise jwise@draga.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (NetBSD) iD8DBQFIPrGtq/KRbT0KwbwRArN+AJ0QTuytahkUluOYpCHQ9jw94gNWFQCfTQ5c 2V0w8OO3EnCnJvb3lYh1+sQ= =o9Ro -----END PGP SIGNATURE-----