Subject: iSCSI: SecurityContextComplete without operational parameters

From: "Eddy Quicksall" <[email-masked]>
Date: Tue, 24 Jul 2001 08:55:05 -0400

In section "4.2 iSCSI Security and Integrity Negotiation", it would be best
if the target is required to send SecurityContextComplete=yes without any
new operational parameters within the same PDU.

It makes coding cleaner because the initiator can have a simple send/receive
loop that pops out when security is complete. If operational parameters are
allowed with SecurityContextComplete=yes, the initiator's security module
must also have operational parameter code or it must set flags, leave
information in buffers, etc that all create messy code.

The spec says:

           If the initiator has been the last to complete the handshake it
           MUST NOT start sending operational parameters within the same
           text command.

How about if we say the same thing for the target? There shouldn't be any
harm because I suspect everyone is doing that anyway.

Comments?

[email-masked]

---

From: "Julian Satran" <[email-masked]>
Date: Tue, 24 Jul 2001 16:51:16 +0300

OK

Julo

"Eddy Quicksall" <[email-masked]> on 24-07-2001 15:55:05

Please respond to "Eddy Quicksall" <[email-masked]>

To:   Julian Satran/Haifa/IBM@IBMIL
cc:   [email-masked]
Subject:  iSCSI: SecurityContextComplete without operational parameters

It makes coding cleaner because the initiator can have a simple
send/receive

The spec says:

Comments?

---

From: "Julian Satran" <[email-masked]>
Date: Thu, 26 Jul 2001 19:35:55 +0300

Eddy,

I am working on it.

Thanks for your patience,
Julo

"Eddy Quicksall" <[email-masked]> on 26-07-2001 19:17:58

Please respond to "Eddy Quicksall" <[email-masked]>

To:   Julian Satran/Haifa/IBM@IBMIL
cc:   [email-masked]
Subject:  Re: iSCSI: SecurityContextComplete without operational parameters

Julian,

This thread seems to have gone a bit further than my original request. I
don't see an answer to the below. Can you please let me know?

Again, all I am asking is that both initiator and target have the same
rule.
It seems simple and constructive to do so. I can rationalize it again if
you
like.

Eddy
----- Original Message -----
From: "Eddy Quicksall" <[email-masked]>
To: "Julian Satran" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, July 25, 2001 4:23 PM
Subject: Re: iSCSI: SecurityContextComplete without operational parameters

> I'm not sure we are talking the same thing. What I'm asking is that the
> target and initiator both have the same rule regarding the fact that "it
> MUST NOT start sending operational parameters within the same text
command"
> when SecurityContextComplete=yes.
>
> Eddy
> ----- Original Message -----
> From: "Julian Satran" <[email-masked]>
> To: <[email-masked]>
> Sent: Wednesday, July 25, 2001 2:49 AM
> Subject: Re: iSCSI: SecurityContextComplete without operational
parameters
>
>
> > Eddy,
> >
> > I understood what you are asking but I don't necessarily agree.
> Operational
> > parameters are problematic if you want them exchanged in a secure
> > environment. If not you should be able to handle them as you should be
> able
> > to handle
> > any set of parameters on the same PDU. The need to keep them and
perhaps
> > reset them is part of the negotiation process.
> >
> > Julo
> >
> > "Eddy Quicksall" <[email-masked]> on 24-07-2001 20:35:18
> >
> > Please respond to "Eddy Quicksall" <[email-masked]>
> >
> > Subject:  Re: iSCSI: SecurityContextComplete without operational
> parameters
> >
> >
> >
> >
> > What I was actually asking for is that the target would not send any
> > operational parameters in the same PDU as the SecurityContextComplete.
> > Rationalization given below.
> >
> > Eddy
> >
> > ----- Original Message -----
> > From: "Julian Satran" <[email-masked]>
> > To: <[email-masked]>
> > Sent: Tuesday, July 24, 2001 10:08 AM
> > Subject: Re: iSCSI: SecurityContextComplete without operational
parameters
> > > the new text will read:
> > MUST
> > >       NOT start sending operational parameters that need to be
protected
> > >       within the same text command; a text response including only
> > >       SecurityContextComplete=yes concludes the security sub-phase.
Only
> > >       the following PDU exchange is protected by digests (if any).
> > >
> > > If the target has been the last to complete the handshake, the
initiator
> > > can start the operational parameter negotiation with the next text
> > command;
> > > the security negotiation sub-phase ends with the target text
response.
> > > However, the target handshake concluding response MUST NOT include
> > > operational parameters that need to be protected. Only the following
PDU
> > > exchange is protected by digests (if any).
> > >
> > > Julo
> > >
> > > In section "4.2 iSCSI Security and Integrity Negotiation", it would
be
> > best
> > > loop that pops out when security is complete. If operational
parameters
> > are
> > >            If the initiator has been the last to complete the
handshake
> > it