Information About Boot Integrity Visibility

Boot Iintegrity Visibility allows Cisco's platform identity and software integrity information to be visible and actionable. Platform identity provides the platform’s manufacturing installed identity. Software integrity exposes boot integrity measurements that can be used to assess whether the platform has booted trusted code.

During the boot process, the software creates a checksum record of each stage of the bootloader activities.

You can retrieve this record and compare it with a Cisco-certified record to verify if your software image is genuine. If the checksum values do not match, you may be running a software image that is either not certified by Cisco or has been altered by an unauthorized party.


Note

Boot Integrity Visibility is supported only on the active supervisor. It does not support high availability scenarios.

Verifying the Software Image and Hardware

This task describes how to retrieve the checksum record that was created during a router bootup. Enter the following commands in privileged EXEC mode.


Note

On executing the following commands, you might see the message % Please Try After Few Seconds displayed on the CLI. This does not indicate a CLI failure, but indicates setting up of underlying infrastructure required to get the required output. We recommend waiting for a few minutes and then try the command again.

The messages % Error retrieving SUDI certificate and % Error retrieving integrity data signify a real CLI failure.

  1. show platform sudi certificate [ sign [ nonce nonce]]

  2. show platform integrity [ sign [ nonce nonce]]

Verifying Platform Identity and Software Integrity

Verifying Platform Identity

The following example displays the Secure Unique Device Identity (SUDI) chain in PEM format. The first certificate is the Cisco Root CA 2048 and the second is the Cisco subordinate CA (ACT2 SUDI CA). Both certificates can be verified to match those published on https://www.cisco.com/security/pki/. The third is the SUDI certificate. 

Device# show platform  sudi  certificate sign  nonce 123
-----BEGIN CERTIFICATE-----
MIIDQzCCAiugAwIBAgIQX/h7KCtU3I1CoxW1aMmt/zANBgkqhkiG9w0BAQUFADA1
MRYwFAYDVQQKEw1DaXNjbyBTeXN0ZW1zMRswGQYDVQQDExJDaXNjbyBSb290IENB
IDIwNDgwHhcNMDQwNTE0MjAxNzEyWhcNMjkwNTE0MjAyNTQyWjA1MRYwFAYDVQQK
Ew1DaXNjbyBTeXN0ZW1zMRswGQYDVQQDExJDaXNjbyBSb290IENBIDIwNDgwggEg
MA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQCwmrmrp68Kd6ficba0ZmKUeIhH
xmJVhEAyv8CrLqUccda8bnuoqrpu0hWISEWdovyD0My5jOAmaHBKeN8hF570YQXJ
FcjPFto1YYmUQ6iEqDGYeJu5Tm8sUxJszR2tKyS7McQr/4NEb7Y9JHcJ6r8qqB9q
VvYgDxFUl4F1pyXOWWqCZe+36ufijXWLbvLdT6ZeYpzPEApk0E5tzivMW/VgpSdH
jWn0f84bcN5wGyDWbs2mAag8EtKpP6BrXruOIIt6keO1aO6g58QBdKhTCytKmg9l
Eg6CTY5j/e/rmxrbU6YTYK/CfdfHbBcl1HP7R2RQgYCUTOG/rksc35LtLgXfAgED
o1EwTzALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUJ/PI
FR5umgIJFq0roIlgX9p7L6owEAYJKwYBBAGCNxUBBAMCAQAwDQYJKoZIhvcNAQEF
BQADggEBAJ2dhISjQal8dwy3U8pORFBi71R803UXHOjgxkhLtv5MOhmBVrBW7hmW
Yqpao2TB9k5UM8Z3/sUcuuVdJcr18JOagxEu5sv4dEX+5wW4q+ffy0vhN4TauYuX
cB7w4ovXsNgOnbFp1iqRe6lJT37mjpXYgyc81WhJDtSd9i7rp77rMKSsH0T8lasz
Bvt9YAretIpjsJyp8qS5UwGH0GikJ3+r/+n6yUA4iGe0OcaEb1fJU9u6ju7AQ7L4
CYNu/2bPPu8Xs1gYJQk0XuPL1hS27PKSb3TkL4Eq1ZKR4OCXPDJoBYVL0fdX4lId
kxpUnwVwwEpxYB5DC2Ae/qPOgRnhCzU=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEPDCCAySgAwIBAgIKYQlufQAAAAAADDANBgkqhkiG9w0BAQUFADA1MRYwFAYD
VQQKEw1DaXNjbyBTeXN0ZW1zMRswGQYDVQQDExJDaXNjbyBSb290IENBIDIwNDgw
HhcNMTEwNjMwMTc1NjU3WhcNMjkwNTE0MjAyNTQyWjAnMQ4wDAYDVQQKEwVDaXNj
bzEVMBMGA1UEAxMMQUNUMiBTVURJIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEA0m5l3THIxA9tN/hS5qR/6UZRpdd+9aE2JbFkNjht6gfHKd477AkS
5XAtUs5oxDYVt/zEbslZq3+LR6qrqKKQVu6JYvH05UYLBqCj38s76NLk53905Wzp
9pRcmRCPuX+a6tHF/qRuOiJ44mdeDYZo3qPCpxzprWJDPclM4iYKHumMQMqmgmg+
xghHIooWS80BOcdiynEbeP5rZ7qRuewKMpl1TiI3WdBNjZjnpfjg66F+P4SaDkGb
BXdGj13oVeF+EyFWLrFjj97fL2+8oauV43Qrvnf3d/GfqXj7ew+z/sXlXtEOjSXJ
URsyMEj53Rdd9tJwHky8neapszS+r+kdVQIDAQABo4IBWjCCAVYwCwYDVR0PBAQD
AgHGMB0GA1UdDgQWBBRI2PHxwnDVW7t8cwmTr7i4MAP4fzAfBgNVHSMEGDAWgBQn
88gVHm6aAgkWrSugiWBf2nsvqjBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vd3d3
LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY3JsL2NyY2EyMDQ4LmNybDBQBggrBgEF
BQcBAQREMEIwQAYIKwYBBQUHMAKGNGh0dHA6Ly93d3cuY2lzY28uY29tL3NlY3Vy
aXR5L3BraS9jZXJ0cy9jcmNhMjA0OC5jZXIwXAYDVR0gBFUwUzBRBgorBgEEAQkV
AQwAMEMwQQYIKwYBBQUHAgEWNWh0dHA6Ly93d3cuY2lzY28uY29tL3NlY3VyaXR5
L3BraS9wb2xpY2llcy9pbmRleC5odG1sMBIGA1UdEwEB/wQIMAYBAf8CAQAwDQYJ
KoZIhvcNAQEFBQADggEBAGh1qclr9tx4hzWgDERm371yeuEmqcIfi9b9+GbMSJbi
ZHc/CcCl0lJu0a9zTXA9w47H9/t6leduGxb4WeLxcwCiUgvFtCa51Iklt8nNbcKY
/4dw1ex+7amATUQO4QggIE67wVIPu6bgAE3Ja/nRS3xKYSnj8H5TehimBSv6TECi
i5jUhOWryAK4dVo8hCjkjEkzu3ufBTJapnv89g9OE+H3VKM4L+/KdkUO+52djFKn
hyl47d7cZR4DY4LIuFM2P1As8YyjzoNpK/urSRI14WdIlplR1nH7KNDl5618yfVP
0IFJZBGrooCRBjOSwFv8cpWCbmWdPaCQT2nwIjTfY8c=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDeTCCAmGgAwIBAgIEAYF/rTANBgkqhkiG9w0BAQsFADAnMQ4wDAYDVQQKEwVD
aXNjbzEVMBMGA1UEAxMMQUNUMiBTVURJIENBMB4XDTE3MDQyODEwNTU1NVoXDTI3
MDQyODEwNTU1NVowZTElMCMGA1UEBRMcUElEOkM5NTAwLTE2WCBTTjpGQ1cyMTE3
QTU2TTEOMAwGA1UEChMFQ2lzY28xGDAWBgNVBAsTD0FDVC0yIExpdGUgU1VESTES
MBAGA1UEAxMJQzk1MDAtMTZYMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAsenmrNybW0gLru4Y3UakblbFjmHvIwIdEro2HZPewrv/S014tPOAuXSfFdJh
SRAGwhB4ji71P4R9AqoQfrpybq3fJEaJCmakkdP5VBmPLm+QdJwGc7GGiUuXr6/R
PTjzdfVTJ0uvEi/holnTrYuHiu0JT3vsXi1bKkl1HJFeGspMCSZRRcoAxIZ8GRFt
+Y5f3QgV7b1Ce4zLSxJqTqiEDUNRuoeGwb+YtQOtep53hnwVoU6bjNaQXjq9pgcJ
dMyhh+zRtaRREpes4B7IZaFSMGeUbGvfVE6R+40mIM+T26fnZa2k4bQvrcm/1Vbe
/6Fy4rniHAXwzGCCgIHfIJMrSwIDAQABo28wbTAOBgNVHQ8BAf8EBAMCBeAwDAYD
VR0TAQH/BAIwADBNBgNVHREERjBEoEIGCSsGAQQBCRUCA6A1EzNDaGlwSUQ9VVlK
T1NqSk1Cd2dhVFc5dUlFOWpkQ0F4TUNBeE1qbzFORG96T0NENE9hQT0wDQYJKoZI
hvcNAQELBQADggEBADxO7Ks4AlSb8WnEq0OMoq+3tiXHLDYVdJUgH0w5FsUoE13f
yxn867saiJVMYrT7+/wTsexxdDJySGAJH5mPdwPPmEfLHw9/D6/l/d6Fsc1M/LeB
q+Q2a6L6oZd1rJJheNQyCN/jOCYuM0dK9JyDjLda9jSa3AL7UsOcr9aciBQ/CjZ6
8bV3x8LzAyPDs++qy6fHgB4OpP8vOJtQdnYGDZAtOun4Jlz3PyXjSJy9XWoWflG+
2nGXg9PCig8l1ppPjDg1prZ60lt+scEEJzqZmoHGn/lelOH4s+mJTVAxbgBudcA3
0XpdeHqOD0OdkG8JkXPYcUQ5in4R6zgwXEnqMzY=
-----END CERTIFICATE-----

Signature version: 1
Signature:
6E1CDAE6DF1E0CD813EDD7B98F5DA18A92191B420D788BD385181F1421B5EC77374BD8C75110C444ACD167C7458729D355B73BF380F8EB70E01402093ECCB41F25C292F2ED7A7380365547CA13B62F3451810AEC78D662C71D73D492F97E10D28CCF8533FAF67CC2FCFAD3F1692589362527C040D65E7ED8DADED28D5FC3F4A7D473CF38EB3B213DC03C47F8EDC2DA699425EB06F57D18164F569EEF6A96E19BB8720701BCDBDE3AE27B7D6937BF9D3EC602F8B7BFB03D72200FF1DB67AD51D0A913C034D9EBE3CBEB12D294722EFC32E49F5B781B367DCC90EAD0259F2F67535C4B40E1B5F539383992409CFB7B148DCD123D9D6E71526A9EBDDC0E3A1242EF

Verifying Software Integrity

The following example displays the checksum record for the boot stages. The hash measurements are displayed for each of the three stages of software successively booted. These hashes can be compared against Cisco-provided reference values. An option to sign the output gives a verifier the ability to ensure the output is genuine and is not altered. A nonce can be provided to protect against replay attacks. 

Device# show platform integrity sign nonce 123
Platform: C9500-16X
Boot 0 Version: MA0081R06.1307262016
Boot 0 Hash: A99EF9F31CE3F3F8533055407F1C88C62176E667E4E1DA0649EAA7A1282F205E0A
Boot Loader Version: System Bootstrap, Version 16.8.0.3, RELEASE SOFTWARE (P)
Boot Loader Hash: F82826514658055C3993AB95F53512341BF20F3CC7D4083C980450EA6CD84608EE636B5B15D13414203CED35603F01974B8676C6AC6F9DC45B25CD1039E686C40A
OS Version: BLD_POLARIS_DEV_LATEST_20171213_030750
OS Hash: E7336A416FB232CA87C73C5C6387EB7244560FBF9F977207D8783C113217DE3DD4CA16C40B16A8CC9841100264D04CAFE3AE863EB94EE561F9851AB167E913830A
PCR0: 9745B571B66D79F0936F4D292B5672B50F50FD1E56E74248D48A33582E992574
PCR8: 1CC295C233DA41BD3530A6F09C21991E8406BFFC88249D7778CA4BB0B9E71EB7
Signature version: 1
Signature:
23E103D9342554D73F16F4CC907F46DA2C66EE69FBAAA47361B286766ADD8172AC6DD9CA259E7E76A5F266FC287312870E2259DB6E9827AB32F943F2B8F77954C4739A8233E7441174567A36E9B0B41A65D964BABA9FA7A53B9DBFF0622A20D780250B25EAA702E38A5FEF2D9A3BD3DA10D74C5C628F538B2A738F1D5875F5F95C339F96C6BD8984374BE92DA20D4447EC8A092B2754ABB706579EBFE0991B6E27427DE8D96162CFDCC3110958F3399783494EDD98FA9C8AAFDC33E91729D14395966F15DE2D0A4A6B2487F3E776E90DAC5060E59B326F67A80A26E6DFD48421B4159F3D52159FA3B11B0170CB766CA29A9F341B67ACFC3A7967F46C41C8A615