Subject: RE: [rddp] rddp security and nfsv4

From: [email-masked]
Date: Mon, 25 Nov 2002 19:16:33 -0500

Without wading too far into this discussion, I'll observe that
Brent and Mike are in violent agreement on one point:
- NFSv4 is already doing all of the key setup needed to secure
	its traffic.
So, in principle, there's no need for IKE for NFSv4, independent of
whether IPsec ESP or RPSEC_GSS encapsulation is used for the data
transferred by RDMA.  This seems right, because RDMA for NFSv4 is
fundamentally an optimization to RPC, hence it's security ought to
be an extension of RPC security, as opposed to something completely
separate and different.

So, to bring this discussion full circle back to IPsec - requiring
IPsec implementation for RDDP for NFSv4 requires IKE for NFSv4, which
seems questionable, and in turn that calls into question a "just use
IPsec, no matter what the ULP" security approach to RDDP, which was
where I was hoping to get to (who, me ... devious ;-) ;-) ).

I'll reserve judgment on the practical utility of varying security
processing within a single NFSv4 transport connection.  One alternative
is to have NFSv4 RPC set up multiple connections with different security
processing and distribute its traffic among them itself so that each
connection does not have to change its security processing on the fly.

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953 **NEW**     FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

> > >>Good news is that RPCSEC_GSS will work just fine even if the
> > >>RPCs are over an RDMA transport.  This will be true for all
> > >>versions of NFS.  But there's bad news too: if integrity protection
> > >>or privacy are used, then the direct placement advantage will likely
> > >>be lost since an extra payload copy is almost inevitable.
> > >
> > >
> > > Why is this inevitable? As you say below, NICs that are smart enough
> > > to understand RDMA might also be smart enough to understand IPsec.
> > > In the end, existing NICs that understand IPsec are just keeping
> > > a session key per security association around and
encrypting/decrypting stuff
> > > based on a cached session key.
> > >
> > > If NFS/RDDP included hints as to where the encrypted and/or decrypted
payload
> > > lived, then this seems feasible to do in the NIC.
> > 
> > Yes, with new APIs, hints and NIC support it's possible, but
> > I don't think the added function is worth the complexity.
> > 
> > You get much the same effect with an RDMA device if you do the
> > authentication with RPCSEC_GSS in the host RPC layer and have
> > IPsec handle encryption/integrity in the RDMA NIC.
> 
> With limitations. Say the NFS server protects some data with
> RPCSEC_GSS privacy and
> other data with just integrity. I know of no way to tell 
> IPsec implementations to
> encrypt some TCp segments and not others; the granularity is 
> at the entire port.
> So now all the traffic to the server has to be encrypted.
> 
> If RDDP is a case of pick one: security or performance, then don't be
> surprised if people say: "neither, thanks, I'll used 
> something that isn't RDDP".
> 
> 	-mre
> _______________________________________________
> rddp mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/rddp
> 
_______________________________________________
rddp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rddp

---

From: "Uri Elzur" <[email-masked]>
Date: Tue, 26 Nov 2002 20:28:09 -0800

I'm intrigued by the NFSv4 solution. IMHO, the WG should 

a. Set a direction - I for one, am not sure that wire protocol security lies within the scope of RDDP. There is a distinction between this and addressing security concerns e.g. Stag scope..
b. Check all applicable alternatives before adopting any solution

Uri

-----Original Message-----
From: Mukund, Shridhar [mailto:[email-masked]]
Sent: Tuesday, November 26, 2002 3:56 PM
To: 'John Hufferd'
Cc: [email-masked]
Subject: RE: [rddp] rddp security and nfsv4

John,

I share your concern ...

> Now Caitlin brings up the point that DDP
> <Snip>
> "is supposed to run over IP transports: especially SCTP and TCP.
> ...
> 
> So whether IPsec is present or not is just not relevant to 
> DDP, anymore
> than whether Ethernet or ATM is the L2 protocol. DDP rides 
> just above L4.
> DDP and IPsec should both be blissfully ignorant of each other."
> <Snip>
> 
> I am not sure that view removes the rddp workgroup from ...

DDP has as much to do with IPSec as iSCSI and other IP 
storage protocols. It should provide continuity of the security 
envelope and protocols such as RDMAP should define the usage 
rigorously. We may want to reuse some of the good work done in 
the context of IP storage security.

IPSec is like a pair of socks. For instance one could choose to:
  - be content with just IP flow security.
  - pull up their socks and secure TCP connection.
  - pull it up a tad bit further and secure iSCSI session.
... or is it like a pair of stockings with garter belt? Hmmn :-)

I believe we need to go beyond the elegance of orthogonality:-), 
and consider how the vital parts of DDP and RDMAP will be secured,
when using IPSec.

-Shridhar Mukund

---

From: "Sukanta Ganguly" <[email-masked]>
Date: Wed, 27 Nov 2002 09:04:31 -0800

I have mentioned this before ine my previous email. I think we are
getting too much of unwanted complexity into the protocol. The IPSec
layer sits below and having NFSv4 have dependencies does on IPSec does
not make a whole of sense. The protocol layers are completely violated.

I definitely see the security angle that is being talked about and
probably should be made a note of and possible choices should be offered
but I don't see the value of forcing IPSec as a requirement.

As Mukund mentioned in his email, considerations and possible choices or
recommendations as fine in the draft. But one could very much have a
secured network already in place and do RDDP based application. In this
mode you don't have to have another IPSec session happening behind the
covers.

I hope I am making my point clear without the possibilities of getting
trampled :-) 

SG

-----Original Message-----
From: Uri Elzur [mailto:[email-masked]] 
Sent: Tuesday, November 26, 2002 8:28 PM
To: Mukund, Shridhar; John Hufferd
Cc: [email-masked]
Subject: RE: [rddp] rddp security and nfsv4

a. Set a direction - I for one, am not sure that wire protocol security
lies within the scope of RDDP. There is a distinction between this and
addressing security concerns e.g. Stag scope.. b. Check all applicable
alternatives before adopting any solution

Uri

-----Original Message-----
From: Mukund, Shridhar [mailto:[email-masked]]
Sent: Tuesday, November 26, 2002 3:56 PM
To: 'John Hufferd'
Cc: [email-masked]
Subject: RE: [rddp] rddp security and nfsv4

John,

I share your concern ...

> "is supposed to run over IP transports: especially SCTP and TCP. ...
> 

I believe we need to go beyond the elegance of orthogonality:-), 
and consider how the vital parts of DDP and RDMAP will be secured, when
using IPSec.

-Shridhar Mukund