Subject: Re: [storm] iSCSI: Authentication mechanism reduction

From: <[email-masked]>
Date: Wed, 23 Jun 2010 16:12:48 -0400

Reviewing this thread, I believe I see consensus (actual consensus, not
just rough) for removing SPKM1 and SPKM2.  It will be necessary to
instruct IANA to mark the SPKM_ text key prefix as obsolete and not to
be reused as part of removing these mechanisms.

For now, KRB5 and SRP need to stay in the combined iSCSI draft.

Thanks,
--David

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
Of Julian Satran
> Sent: Saturday, May 22, 2010 11:49 PM
> To: Paul Koning
> Cc: Ofer Biran; [email-masked]
> Subject: Re: [storm] iSCSI: Authentication mechanism reduction
> 
> 
>   Paul,
> 
> There where patent concerns (none confirmed!) but SRP by far the
authors
> preference (simplest, secure)
> and it would be a mistake to take it out. Enough to have it optional
> :-). At least we have an interoperable description.
> 
> Julo
> 
> On 22/05/10 19:17, Paul Koning wrote:
> > I agree about keeping Kerberos.
> >
> > If we're looking at pulling out stuff, how about yanking SRP?  In
spite
> > of its arguable technical superiority I believe patent concerns
have,
> > and will, keep it from being used.
> >
> > 	paul
> >
> >> -----Original Message-----
> >> From: [email-masked] [mailto:[email-masked]] On
Behalf
> >> Of Julian Satran
> >> Sent: Saturday, May 22, 2010 4:58 AM
> >> To: [email-masked]
> >> Cc: Ofer Biran
> >> Subject: Re: [storm] iSCSI: Authentication mechanism reduction
> >>
> >>
> >>    Hm... Kerberos is widely deployed even if common iSCSI
initiators
> > are
> >> not using it.
> >> Wouldn't it be wiser to "revive" the GSSAPI version and have it
> > replace
> >> the current wording.
> >> And it is certainly better than to be left with CHAP :-) (as the
> >> primary).
> >>
> >> Julo
> >>
> >>
> >> On 22/05/10 04:43, [email-masked] wrote:
> >>> <WG chair hat off>
> >>>
> >>> I'd like to propose removal of a few authentication mechanisms.
RFC
> >> 3720 currently specifies five authentication mechanisms:
> >>> 	- Kerberos (KRB5)
> >>> 	- Simple public key (SPKM1 and SPKM2)
> >>> 	- Secure Remote Password (SRP)
> >>> 	- Challenge Handshake (CHAP)
> >>>
> >>> To my knowledge, SPKM1 and SPKM2 have never been implemented and
are
> >> not in use.  KRB5 has been implemented, but my understanding is
that
> > it
> >> is not in use, and I understand that the specific iSCSI usage of
> >> Kerberos isn't considered be the proverbial "right thing" to do
> > because
> >> it's not based on GSSAPI.  There was an Internet-Draft on adding
> >> GSSAPI-based Kerberos authentication to iSCSI, but it's long since
> >> expired.
> >>> So, I would suggest removal of the KRB5, SPKM1 and SPKM2 methods
> > from
> >> the iSCSI consolidated draft with suitable reservation of the
> >> authentication method names and negotiation key prefixes (KRB_AP_,
> >> SPKM_) to prevent future reuse.
> >>> Thanks,
> >>> --David
> >>> ----------------------------------------------------
> >>> David L. Black, Distinguished Engineer
> >>> EMC Corporation, 176 South St., Hopkinton, MA  01748
> >>> +1 (508) 293-7953             FAX: +1 (508) 293-7786
> >>> [email-masked]        Mobile: +1 (978) 394-7754
> >>> ----------------------------------------------------
> >>>
> >>> _______________________________________________
> >>> storm mailing list
> >>> [email-masked]
> >>> https://www.ietf.org/mailman/listinfo/storm
> >> _______________________________________________
> >> storm mailing list
> >> [email-masked]
> >> https://www.ietf.org/mailman/listinfo/storm
> 
> _______________________________________________
> storm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/storm