Subject: RE: iSCSI: IPsec tunnel / transport mode decision

From: "Ofer Biran" <[email-masked]>
Date: Fri, 9 Nov 2001 19:53:45 +0200

It seems that most people prefer tunnel over transport mode
and there is no real opposition for choosing tunnel mode as
the MUST. In view of that we intend to add it in version 09
in the following iSCSI statements:

In Section 10.3.1 Data Integrity and Authentication :

"An iSCSI compliant initiator or target MUST provide data
integrity and authentication by implementing IPSec [RFC2401]
with ESP in tunnel mode [RFC2406] with the following..."

And in Section 10.3.2 Confidentiality :

"An iSCSI compliant initiator or target MUST provide
confidentiality by implementing IPSec [RFC2401] with
ESP in tunnel mode [RFC2406] with the following..."

Any objection ?

  Regards,
    Ofer

Ofer Biran
Storage and Systems Technology
IBM Research Lab in Haifa
[email-masked]  972-4-8296253

"Saqib Jang" <[email-masked]> on 01/11/2001 20:03:29

Please respond to <[email-masked]>

To:   Ofer Biran/Haifa/IBM@IBMIL, <[email-masked]>
cc:
Subject:  RE: iSCSI: IPsec tunnel / transport mode decision

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Ofer Biran
Sent: Thursday, November 01, 2001 4:31 AM
To: [email-masked]
Subject: iSCSI: IPsec tunnel / transport mode decision

I'd like to drive this open issue into group consensus. It seems to
me that the tendency was more toward making tunnel mode a MUST as iFCP
and FCIP did, mainly due the option of integrating an existing IPsec
chip/box with the iSCSI implementation offering. If we reach this decision,
we may choose even not to mention transport mode (as MAY or some other
recommending text).

There is an excellent analysis made by Bernard Aboba in Section
"5.1. Transport mode versus tunnel mode" of draft-ietf-ips-security-04
( http://www.ietf.org/internet-drafts/draft-ietf-ips-security-04.txt )
that can help us with this decision (also Section "5.2. NAT traversal" is
relevant).

   Regards,
     Ofer

Ofer Biran
Storage and Systems Technology
IBM Research Lab in Haifa
[email-masked]  972-4-8296253

---

From: Paul Koning <[email-masked]>
Date: Fri, 9 Nov 2001 16:42:54 -0500 (EST)

I'm not sure if this is the sort of answer your question was looking
for, but I don't want to let silence be taken for agreement, so...

I'm opposed to the presence of "MUST" in sections 10.3.1 and 10.3.2
for reasons stated in mail to this list a week or two ago.

    paul

---

From: "Saqib Jang" <[email-masked]>
Date: Fri, 9 Nov 2001 14:41:59 -0800

Two pts. First, I believe that either flavor of IPsec 
has to be a MUST-to-implement requirement for iSCSI to be 
viewed as a 'secure' protocol, so I'm in favor of the 
proposed statements to that extent. Second, my vote is
in favor of transport mode to avoid folks playing 'marketing'
games with positioning their products as iSCSI compliant.

Saqib

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Ofer Biran
Sent: Friday, November 09, 2001 9:54 AM
To: [email-masked]
Subject: RE: iSCSI: IPsec tunnel / transport mode decision

Any objection ?

  Regards,
    Ofer

Ofer Biran

-----Original Message-----

   Regards,
     Ofer

Ofer Biran

---

From: Sukanta ganguly <[email-masked]>
Date: Fri, 9 Nov 2001 11:07:00 -0800 (PST)

By doing this we are forcing IPSec. No flexibility of
going transport over tunnel. I think we were still
having a discussion of whether transport can also be
supported and hence instead of forcing with IPSec
can't we allow both mechanisms to a MAY.

In that scenario one could opt for transport mode with
tunnel and still have a good implementation running.
What do other think?

SG

--- Ofer Biran <[email-masked]> wrote:
> data
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of
> Ofer Biran
> (
http://www.ietf.org/internet-drafts/draft-ietf-ips-security-04.txt
> )

__________________________________________________
Do You Yahoo!?
Find a job, post your resume.
http://careers.yahoo.com

---

From: "Bill Strahm" <[email-masked]>
Date: Fri, 9 Nov 2001 15:38:05 -0800

I don't understand what you are really asking for...
Do you want both Transport & Tunnel mode to be a MAY ?
Do you want the option to not have either ?
Do you expect to run Transport mode ESP through a Tunnel Mode ESP transform
?
Do you expect to run another security protocol (for example TLS) ?

I think we should just say, we require (a MUST) a 2401 IPsec implementation
(and all the other random IPsec RFCs as well) (This answers the first three
questions above)

I think we should allow TLS rather than IPsec (this has lost a long time in
the WG, so I am pretty much just giving up) (answers the 4th question)

Bill
-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Sukanta ganguly
Sent: Friday, November 09, 2001 11:07 AM
To: Ofer Biran; [email-masked]
Subject: RE: iSCSI: IPsec tunnel / transport mode decision

SG

---

From: Sukanta ganguly <[email-masked]>
Date: Fri, 9 Nov 2001 16:18:35 -0800 (PST)

Bill,
I was very clear in my email. Let me put this is
simple words. I was expecting a MAY for IPSec and a
MAY for TLS. A MUST for IPSec i.e. 2401 rules out
everything. Seems like IPSec has already been decided
already. 

SG

--- Bill Strahm <[email-masked]> wrote:
> > and there is no real opposition for choosing
> tunnel
> > mode as
> > In Section 10.3.1 Data Integrity and
> Authentication
> > :
> >
> > "Saqib Jang" <[email-masked]> on
> 01/11/2001
> > 20:03:29
> >
> > chip/box with the iSCSI implementation offering.
> If
> > we reach this decision,
> > we may choose even not to mention transport mode
> (as
> > MAY or some other
> > recommending text).
> >
> > There is an excellent analysis made by Bernard
> Aboba
> > in Section