Subject: iSCSI: IKE normative guidelines

From: "Ofer Biran" <[email-masked]>
Date: Fri, 9 Nov 2001 20:05:54 +0200

In the framework of the effort being done now by the security team
to sync the normative statements in the security draft with the
protocol drafts, I suggest to adopt the following IKE normative
guidelines that already appear in the security draft for iSCSI:

==================================================================

"Conformant iSCSI, iFCP and FCIP implementations MUST support peer
authentication using a pre-shared key, and MAY support
certificate-based peer authentication using digital signatures.
Peer authentication using the public key encryption methods outlined
in IKE's sections 5.2 and 5.3[7] SHOULD NOT be used.

...Conformant iSCSI, FCIP and iFCP security implementations MUST support
both IKE Main Mode and Aggressive Mode

...When digital signatures are used to achieve authentication, an IKE
negotiator SHOULD use IKE Certificate Request Payload(s) to specify the
certificate authority

...IKE negotiators SHOULD check the pertinent Certificate Revocation
List (CRL) before accepting a PKI certificate for use in IKE's
authentication procedures"

==================================================================

 Regards,
   Ofer

Ofer Biran
Storage and Systems Technology
IBM Research Lab in Haifa
[email-masked]  972-4-8296253

---

From: Paul Koning <[email-masked]>
Date: Fri, 9 Nov 2001 16:44:37 -0500 (EST)

>>>>> "Ofer" == Ofer Biran <[email-masked]> writes:

 Ofer> In the framework of the effort being done now by the security
 Ofer> team to sync the normative statements in the security draft
 Ofer> with the protocol drafts, I suggest to adopt the following IKE
 Ofer> normative guidelines that already appear in the security draft
 Ofer> for iSCSI: ...

Does any of this differ from what's in RFC 2408/2409?  If so, why?  If
not, why not just refer to that standard and say nothing further?

If we're going to be different, I'd suggest dropping aggressive mode
since main mode is at least as good.

      paul