Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes.
Let's say I have tripwire configured to run nightly and installed it on a fresh non-rootkitted system.
Then at noon today a skilled intruder installs a rootkit to my system.
How do I know their rootkit hasn't replaced my tripwire with a tripwire impersonator; using a different set of public/private keys (and fake authentication binaries) that more or less replays the last files (readable with public key) to assure me that no checksums are changing (essentially just replaying known log files). I guess I could notice that my private passphrase no longer works to open the private key; but I don't think it would be that difficult to let any password work (or just the first one typed in). I guess I should be checking the file sizes/shasum/md5sum of tripwire with known values, but on my rootkitted system all those utilities could be compromised.
I'm looking at the documentation from http://sourceforge.net/projects/tripwire/files/tripwire-src/2.3.0-docs-pdf/ and don't see how tripwire provides any extra security -- besides making the rootkit developers have to work a little harder (to mimic one extra utility as configured by the user).
In practice, I doubt I'd ever routinely boot off a live cd to check hashes safely; so I am wondering if it provides any safety or if its just security theater.