Subject: iSCSI Login Questions

From: Steve Senum <[email-masked]>
Date: Thu, 19 Jul 2001 15:28:55 -0500

Julian:

Is the following valid (taking into account the
changes requested from the UNH Plugfest)?

I: Login: AuthMethod:none SecurityContextComplete=Yes

I would assume not, that the initiator must wait
until after the initial exchange of the AuthMethod, HeaderDigest,
and DataDigest keys to send the SecurityContextComplete
key.

Also, if further simplification of the login process
is desired, the working group might want to consider requiring
the initiator to send the AuthMethod HeaderDigest and
the DataDigest keys on the first login, so that the
login sequence would always look like:

I: Login:   AuthMethod=a1,a2,aN
            HeaderDigest=hd1,hd2,hdN
            DataDigest=dd1,dd2,ddN
T: LoginPR: AuthMethod=a1
            HeaderDigest=hd1 DataDigest=dd1
...Authentication phase, if needed
I: Text:    SecurityContextComplete=yes
T: Text:    SecurityContextComplete=yes
...Operational Parameter Negotiating phase
...Full Feature Phase

Regards,
Steve Senum

---

From: "Barry Reinhold" <[email-masked]>
Date: Thu, 19 Jul 2001 18:02:29 -0400

Steve,
	I would think that this is valid independent of the changes that have been
discussed at the UNH GTP. The initiator has all the information that it
needs for security and is indicating that by setting
securitycontextcomplete=yes. If the target responds with with
AuthMethod=none and SecurityContextComplete=yes then full security phase is
history. However, the initiator needs to be ready to allow the target to
continue the negotiation. (i.e. if the initiator receives a PDU back with
securitycontextcomplete=no it must continue to send text commands in the
security phase even if it does not have any additional parameters it wishes
to communicate.) The target may also respond to the AuthMethod=None with
AuthMethod=Reject, or it might reject the login with a status of 0x0201
(Auth failed).
	All of these responses appear to be valid based on 6-97. It would probably
benefit us to limit the choices here.
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]On Behalf Of
>Steve Senum
>Sent: Thursday, July 19, 2001 4:29 PM
>To: ietf-ips
>Subject: iSCSI Login Questions
>
>
>Julian:
>

---

From: Steve Senum <[email-masked]>
Date: Thu, 19 Jul 2001 17:22:14 -0500

Barry,

By my reading of the current draft, I don't think
SecurityContextComplete=no is valid.

Regards,
Steve Senum