Subject: [storm] iSCSI: Authentication mechanism reduction

From: <[email-masked]>
Date: Fri, 21 May 2010 21:43:25 -0400

<WG chair hat off>

I'd like to propose removal of a few authentication mechanisms.  RFC 3720 currently specifies five authentication mechanisms:
	- Kerberos (KRB5)
	- Simple public key (SPKM1 and SPKM2)
	- Secure Remote Password (SRP)
	- Challenge Handshake (CHAP)

To my knowledge, SPKM1 and SPKM2 have never been implemented and are not in use.  KRB5 has been implemented, but my understanding is that it is not in use, and I understand that the specific iSCSI usage of Kerberos isn't considered be the proverbial "right thing" to do because it's not based on GSSAPI.  There was an Internet-Draft on adding GSSAPI-based Kerberos authentication to iSCSI, but it's long since expired.

So, I would suggest removal of the KRB5, SPKM1 and SPKM2 methods from the iSCSI consolidated draft with suitable reservation of the authentication method names and negotiation key prefixes (KRB_AP_, SPKM_) to prevent future reuse.

Thanks,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

---

From: Julian Satran <[email-masked]>
Date: Sat, 22 May 2010 11:57:37 +0300

Hm... Kerberos is widely deployed even if common iSCSI initiators are 
not using it.
Wouldn't it be wiser to "revive" the GSSAPI version and have it replace 
the current wording.
And it is certainly better than to be left with CHAP :-) (as the primary).

Julo

On 22/05/10 04:43, [email-masked] wrote:
> _______________________________________________
> storm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/storm

---

From: "Paul Koning" <[email-masked]>
Date: Sat, 22 May 2010 12:17:22 -0400

I agree about keeping Kerberos.

If we're looking at pulling out stuff, how about yanking SRP?  In spite
of its arguable technical superiority I believe patent concerns have,
and will, keep it from being used.

	paul

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Julian Satran
> Sent: Saturday, May 22, 2010 4:58 AM
> To: [email-masked]
> Cc: Ofer Biran
> Subject: Re: [storm] iSCSI: Authentication mechanism reduction
> 
> 
> > I'd like to propose removal of a few authentication mechanisms.  RFC
> 3720 currently specifies five authentication mechanisms:
> > 	- Kerberos (KRB5)
> > To my knowledge, SPKM1 and SPKM2 have never been implemented and are
> not in use.  KRB5 has been implemented, but my understanding is that
it
> is not in use, and I understand that the specific iSCSI usage of
> Kerberos isn't considered be the proverbial "right thing" to do
because
> it's not based on GSSAPI.  There was an Internet-Draft on adding
> GSSAPI-based Kerberos authentication to iSCSI, but it's long since
> expired.
> >
> > So, I would suggest removal of the KRB5, SPKM1 and SPKM2 methods
from
> the iSCSI consolidated draft with suitable reservation of the
> authentication method names and negotiation key prefixes (KRB_AP_,
> SPKM_) to prevent future reuse.
> >
> > Thanks,
> > --David

---

From: Julian Satran <[email-masked]>
Date: Sun, 23 May 2010 06:49:15 +0300

Paul,

There where patent concerns (none confirmed!) but SRP by far the authors 
preference (simplest, secure)
and it would be a mistake to take it out. Enough to have it optional 
:-). At least we have an interoperable description.

Julo