Subject: RE: iSCSI Security rough consensus

From: [email-masked]
Date: Wed, 16 May 2001 02:52:01 -0400

> But I don't have any problem with specifying how
> SRP can be used to key ESP.  My question is whether
> we should make this a REQUIRED-TO-IMPLEMENT right now
> at this moment.

That is definitely NOT going to happen at this moment.  At a
minimum, a draft specifying the details sufficient to allow review
by security experts is necessary, and then what to do with that
draft becomes something for the WG to take up.  Ok?

--David
---------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 42 South St., Hopkinton, MA  01748
+1 (508) 435-1000 x75140     FAX: +1 (508) 497-8500
[email-masked]       Mobile: +1 (978) 394-7754
---------------------------------------------------

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 16 May 2001 01:47:12 -0700 (PDT)

> draft becomes something for the WG to take up.  Ok?

Do we have a set of guidelines about what this draft is supposed to
achieve? For example:

1. Do we need to support negotiation of SRP prime modulus/generator
groups from within the standard set? 

2. Do we need to generate keying material for Phase 1 as well as Phase 2
SAs? 

3. Do we need to support rekeys?

4. Do we need to support ciphersuite negotiations?

5. Is there a need to negotiate filters? 

6. Is there a need for concealment of identities?

In other words, how much of IKE are you willing to throw away? While a lot
of IKE complexity is due to artifacts of now discarded layering, a lot of
it is also due to the generality of what it tries to achieve. If you want
less features, you can get a lighter weight protocol...