Subject: RE: Storage over Ethernet/IP

From: [email-masked]
Date: Fri, 26 May 2000 09:40:28 -0500

Encryption will be offloaded to the network interface.  ASICs on the NICs
will greatly improve encryption and authentication performance.  It won't
run over the Internet because of latencies inherent on the public network.
It will run over incredibly fast Packet over SONET Wide Area
Networks--behind firewalls.  OC-192 and soon-to-come OC-768 (terrabit)
switches will be the backbone of WANs and MANs of large networks in a few
years.  Also, IPv6 has significantly improved authentication capabilities
that will help ensure security on the Storage WAN (SWAN?)

Brian

-----Original Message-----
From: Keith Moore [mailto:[email-masked]]
Sent: Friday, May 26, 2000 9:23 AM
To: Jon William Toigo
Cc: [email-masked]
Subject: Re: Storage over Ethernet/IP 

None of the cited limitations of TCP performance are true.
they are also missing the point.

If you're going to run storage access over IP then you are potentially
allowing it to be run over the global Internet.  If you do that you need
good authentication and privacy, and (if you try to do them in software)
authentication and encyption will eat far more in performance than 
anything inherent to TCP or IP.

and no, it's not acceptable to assume that the storage device will be 
behind a firewall.

Keith

---

From: Keith Moore <[email-masked]>
Date: Fri, 26 May 2000 11:01:21 -0400

> will greatly improve encryption and authentication performance.

all well and good, provided that this encryption and authentication
are actually compatible with that specified by higher level protocols
and the authentication actually meets the needs of users.  
(if your network interface needs to use and verify users' credentials,
as opposed to the host's credentials, it might be a stretch.)

> It won't run over the Internet because of latencies inherent on the 
> public network.

at least for some storage applications, latency is not as important
as bandwidth.  e.g. you can do backups over a high-latency medium
as long as your bandwidth is adequate (though recovery from write 
errors gets a bit tricky).

> Networks--behind firewalls.

I'm sure it will be used behind firewalls in some cases but it's 
inappropriate to assume that it will always be used behind firewalls.
Firewalls don't help with the majority of security threats, and
it's less and less the case that network topologies reflect
trust domains.

Keith

---

From: RJ Atkinson <[email-masked]>
Date: Fri, 26 May 2000 11:53:30 +0100

At 15:40 26-05-00 , [email-masked] wrote:
>years.

         I'll note that at least one vendor has already demonstrated
10 Gig Ethernet switch interfaces at Interop/LV earlier this month.
Such 10 GE boxes are generally much less expensive than OC-192 POS boxes.
Another post indicated that these systems will use frame sizes of 1024 bytes,
which is well within the abilities of any Ethernet interface.

>Also, IPv6 has significantly improved authentication capabilities

         IPv6 has NO authentication capability not already shipping for IPv4,
speaking as the person who designed both AH and ESP.  Marketing aside,
there is nothing in IPv6 that makes it more easily secured than IPv4.
Both support AH and ESP.  Deployed ISAKMP/IKE support IPv4, but might
not support IPv6.

         Note that I have no axe to grind for or against IPv6, but the
disinformation campaign that "IPv6 is secure and IPv4 isn't" is
highly annoying and completely wrong.

Ran
[email-masked]

---

From: [email-masked]
Date: Fri, 26 May 2000 09:09:24 -0800 (PST)

> as opposed to the host's credentials, it might be a stretch.)

FWIW, it has been tried, and it didn't succeed in the market, although whether
that was a matter of timing, insufficient market push, or no market existing
isn't clear.

Specifically, Digital used to make a little gadget called a Cryptonette that
you inserted into your Ethernet cable that did this. (The chip inside was
something called a TANDU, and had DES and two Ethernet ports built in. The
whole thing was the size of a pack of cards.)

And I believe there were at least two other similar gadgets at some point,
although I cannot recall their names...

The demo I saw had the boxes doing IPSEC-style operations (this was before
IPSEC was standardized), with the credential verification being done on the
host side.

OTOH, at least one of the problems with these sorts of things is that it's hard
to change the cryptography embedded in them. So, while I think hardware
cryptographic acceleration of this sort could be quite useful, I'm skeptical
that it will ever be something that is universally deployed.

> errors gets a bit tricky).

Yep. Backups done over the public Internet (usually with an appalling lack of
security, alas) are actually quite common.

				Ned