Subject: RE: iSCSI Security rough consensus

From: Joshua Tseng <[email-masked]>
Date: Fri, 4 May 2001 12:29:47 -0700

See below:
> 
> By comparison to full IPSec with IKE, using
> SRP to key ESP does not improve security.
> The underlying issue is IKE complexity (i.e.,
> the code and effort required to implement it).
> 
> Hence the rationale for using SRP to key
> ESP is that it provides dynamic key
> generation without implementing IKE -- this
> is an improvement over pre-shared keys at
> a much lower code and effort cost for a
> single-box (i.e., no external security gateway)
> implementation.

What I think I'm hearing you say is that you
are evaluating whether to REQUIRE SRP keying of
ESP/IPSec because its easier to do than IKE.
If so, then in the first place, I don't think that
is an appropriate justification for a requirement.
In the second place, I'm not sure I even agree with
that statement--there are many off-the-shelf IKE
implementations which can be easily leveraged for
iSCSI with little or no modification.  IKE doesn't
need to be conscious of the application (i.e., iSCSI)
being protected by IPSec.

I also agree with Bernard that this issue is not
specific to iSCSI, and belongs in the security WG.

Josh
> 
> Thanks,
> --David
> 
> ---------------------------------------------------
> David L. Black, Senior Technologist
> EMC Corporation, 42 South St., Hopkinton, MA  01748
> +1 (508) 435-1000 x75140     FAX: +1 (508) 497-8500
> [email-masked]       Mobile: +1 (978) 394-7754
> ---------------------------------------------------
>

---

From: Bernard Aboba <[email-masked]>
Date: Fri, 4 May 2001 15:53:35 -0700 (PDT)

> > SRP to key ESP does not improve security.

Actually, if the comparison is SRP vs. IKE using shared keys, that's not
really true. IKE Shared Key auth is susceptible to man-in-the-middle
attack in that in Main Mode unless the IP addresses of the correspondents
are fixed, there is no way to tie an IP address to an appropriate shared
key. In practice this means the shared group keys must be used. Using the
same shared group key to protect iSCSI for thousands of initiators lacks
credibility, because anyone with the group key (e.g. anyone in the entire
org) can impersonate anyone else. Thus for IKE use in iSCSI, it would seem
that only cert-based auth is tenable. In the most recent survey data I've
seen, less than 15 percent of enterprises have any plans to deploy
certificates. So unless you've got a credible transition solution
(e.g. GetCert, PIC, etc.) it'll be a hard sell.

On the other hand, with SRP, it is possible to identify the endpoints
prior to authentication a la aggressive mode, and thus to maintain
separate passwords for each initiator-target pair. SRP is resistent to
dictionary attacks or compromise of the password database. 

> ESP/IPSec because its easier to do than IKE.

Ease of implementation is *not* the only issue. There is a functionality
issue as well. If you need shared key authentication for hosts with
dynamic IP addresses, IKE Main Mode is not a credible solution.