# Network Boot Trust Network-boot trust concerns how a machine with no trusted operating system selects, retrieves, authenticates, and executes a remote boot program. ## Family The family includes BOOTP, DHCP, PXE and ProxyDHCP, TFTP, UEFI HTTP Boot, option-ROM or firmware network drivers, and chainloaders such as iPXE. ## Evidence to preserve Preserve firmware boot order, NIC and option-ROM identity, DHCP and ProxyDHCP replies, boot-server identity, requested boot filename or URI, downloaded-image hash and signature, TLS or Secure Boot validation state, and server-side access logs. ## Evidentiary boundary A network bearer carrying bootstrap traffic is not necessarily the firmware-selectable boot device. Distinguish the adapter exposed in firmware from the transport path used after bootstrap begins. ## Sources - [[Index - Stages of Interception#Stage 3 — Pre-OS firmware, boot policy, and network boot|Stage 3]]. - UEFI Specification, “Network Protocols — SNP, PXE, BIS and HTTP Boot”: https://uefi.org/specs/UEFI/2.10/24_Network_Protocols_SNP_PXE_BIS.html