Subject: RE: Optional CRCs ( was [rddp] Marker Interval )

From: [email-masked]
Date: Tue, 25 Feb 2003 09:43:41 -0500

Dwight,

> > I think if we are serious about supporting unmodified TCP, then
> > the CRC should be optional.  NFS typically runs with only TCP/UDP
> >
> I think there is a significant delta between "serious about 
> supporting" and "serious about optimizing for".

An alternate viewpoint is that "serious about supporting" includes
"not placing unreasonable implementation requirements upon".  NFS
as currently used does not need CRCs (although NFS did learn the
hard way that turning on checksums was a real good idea), and ...

> > checksum for protection.  Not a good idea to do this over the 
> > public internet, but then critical data traveling through
> > the public internet will (or should) use IPSec protection.
> > 
> And where does the IPSEC processing power come from? I would be
> willing to bet there is a large overlap of candidate environments
> that need to run RDDP in unmodified software stacks that will
> need to run IPSEC in that same unmodified software stack. IPSEC
> is great in its own right, but is certainly not a good tradeoff
> when a CRC would suffice.

To begin with, there's quite a bit of OSV support for IPsec in
existing stacks today.  The point here is not that IPsec is
computationally cheap (it's not), but rather that in an environment
where IPsec is required for security policy reasons and the IPsec
coverage is similar to the CRC coverage, the CRC may not be needed
as the 96-bit IPsec MAC provides a considerably stronger integrity
check - see Section 3.6 of draft-ietf-ips-security-19.txt.  As
Jim Williams wrote:

> > iSCSI is a precedent for optional CRCs.

And there are two scenarios discussed above where the CRC does not
appear to be required.

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------
_______________________________________________
rddp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rddp

---

From: David Robinson <[email-masked]>
Date: Tue, 25 Feb 2003 09:23:20 -0600

> hard way that turning on checksums was a real good idea), and ...

Just so no one is confused, while NFS typically runs over
TCP or UDP using their default checksums and most find that
an adequate solution, NFS also can optionally use RPCSEC_GSS
to add integrity checking if desired. So NFS has belts and
suspenders, although most just wear a belt. Adding yet another
integrity check is not required for NFS.

	-David

---

From: Caitlin Bestler <[email-masked]>
Date: Tue, 25 Feb 2003 10:12:15 -0600

On 2/25/03, [email-masked] wrote:

>An alternate viewpoint is that "serious about supporting"
>includes "not placing unreasonable implementation
>requirements upon".  NFS as currently used does not need
>CRCs (although NFS did learn the hard way that turning on
>checksums was a real good idea), and ...

One aspect of avoiding unreasonable implementation
requirements that I believe we have not paid enough
attention to is trying to increase reusability of software
modules (and gates for hardware solutions).

Specifically, would it be a valid goal to make DDP's
adaptation to TCP be compatible with iSCSI's?

Compatible would not require them to be compatible.
For example, RDDP could require feature that iSCSI
considered to be optional. The benefits in logic
sharing would still apply.

Caitlin Bestler
http://asomi.com/CaitlinBestler/
_______________________________________________
rddp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rddp