Subject: iSCSI: security questions

From: "Lee Xing" <[email-masked]>
Date: Tue, 13 Nov 2001 18:10:02 -0600

Hi,

I got a few questions on iSCSI security.  I would appreciate it if
someone could help.  Thank you.

================
Q1: iSCSI v.08, page 142 "The authentication method cannot assume an
underlying IPSec protection, since IPSec is optional to use."  IPSec is
an option for IPv4, but it's mandatory for IPv6 (if I remember right).
Should we make it more specific?

Q2: iSCSI v.08 Chapter 10 (Security Consideration) mentions a few times
of "...MUST implement...".  Should we add something like "security is
mandatory to implement, but not mandatory to use" in this chapter?  This
is stated explicitly in SEC-IPS v.04 draft, and also implied in Chapter
5 (Login Phase) of iSCSI v.08.

Q3:
SEC-IPS v.04, page 11 "Negotiation between Initiator and Target is used
to determine which authentication algorithm to use (or whether to use
one at all); the connection closes if either side requires
authentication and no mutually acceptable algorithm can be agreed upon"

The question is whether "none" is considered as an "acceptable
algorithm".  In other words, if initiator asks
"AuthMethod=KRB5,SRP,none" during login, and target answers
"AuthMethod=none", should the connection be closed, or should the
initiator continue with LoginOperationalNegotiation stage?  If latter is
acceptable, should we reword the last sentence like "...and no mutually
acceptable algorithm or "none" can be agreed upon"?

Q4:
SEC-IPS v.04, page32 "If IPsec protection is removed on a connection, it
MUST be reinstated before iSCSI, iFCP or FCIP packets are sent."  The
question is do we have to check security every time before sending out
iSCSI packets?

Lee

---

From: "Ofer Biran" <[email-masked]>
Date: Wed, 14 Nov 2001 12:33:51 +0200

Lee,

================

+ IPsec is mandatory to implement in IPV6 but not mandatory to use, the
+ policy can always be configured to plain processing.

+ I think that "MUST implement" is quite clear and standard RFC statement,
+ and you don't need "but optional to use" disclaimer each time it appears.

Q3:

+ "if either side requires authentication" rules out your example,
+ because by suggesting "none" and choosing "none" no side required
+ authentication.

Q4:

+ This statement is going to change as a result of the sync effort with
+ the security draft, at least it would become non-normative.

Regard,
   Ofer

Ofer Biran
Storage and Systems Technology
IBM Research Lab in Haifa
[email-masked]  972-4-8296253

---

From: "Lee Xing" <[email-masked]>
Date: Wed, 14 Nov 2001 09:17:41 -0600

Ofer,

Thanks for the info.  Please see my comments bellow.

Regards,

Lee
Crossroads Systems, Inc.

================
Q3:

# In iSCSI v.08, there are quite a few Login Phase 
# Examples which use "AuthMethod=KRB5,SRP,...,none".
# I'm not sure which one (the Login Phase Examples, or 
# your comments) is more appropriate.

---

From: "Ofer Biran" <[email-masked]>
Date: Wed, 14 Nov 2001 18:16:34 +0200

Lee,

Sorry if I wasn't clear enough. All I was trying to say is
that the statement "the connection closes if either side requires
authentication and no mutually acceptable algorithm can be agreed upon"
is OK since "requires authentication" for the initiator means that he
doesn't offer "none", and "requires authentication" for the target
means that he is not ready to accept "none". The example you gave
is acceptable (as the iSCSI login examples) but doesn't pass the
"if either side requires authentication" condition, so closing
of connection is not implied by it.

  Regards,
    Ofer

Ofer Biran

"Lee Xing" <[email-masked]>@ece.cmu.edu on 14/11/2001 17:17:41

Please respond to "Lee Xing" <[email-masked]>

Sent by:  [email-masked]

To:   <[email-masked]>
cc:
Subject:  RE: iSCSI: security questions

Ofer,

Regards,

Lee
Crossroads Systems, Inc.

================
Q3:

---

From: "Lee Xing" <[email-masked]>
Date: Wed, 14 Nov 2001 11:51:45 -0600

Ofer,

Thanks for the info.  Please see my comments below.

Regards,

Lee Xing
Crossroads Systems, Inc.
=============================
Lee,

+ Let's consider a Login Phase Example:
+
+ I-> Login (CSG,NSG=0,1 T=1)
+     ...
+     AuthMethod=KRB5,SRP,none
+
+ T-> Login-PR (CSG,NSG=0,1 T=1)
+     ...
+     AuthMethod=none
+            
+ does "CSG=0" mean that the initiator "requires
+ authentication"?  If it does, is "none" in Login 
+ AuthMethod list a legal value to have?  If it is,
+ is "none" in Login-PR AuthMethod list a legal value
+ to have even though the target "requires authentication"?
+ If it is, should the connection closes, or should the
+ initiator continue with next Login Stage?  If it 
+ should continue with next Login Stage, then should
+ we reword the paragraph in SEC-IPS v.04?
+ 

  Regards,
    Ofer

Ofer Biran

To:   <[email-masked]>
cc:

Ofer,

Regards,

Lee
Crossroads Systems, Inc.

================
Q3:

---

From: "Ofer Biran" <[email-masked]>
Date: Thu, 15 Nov 2001 19:33:37 +0200

Lee,

"CSG=0" means that the initiator starts the login phase in
the SecurityNegotiation stage. "AuthMethod=KRB5,SRP,none"
means that it doesn't require authentication - since he
offers also the "none" option. And indeed it also sets
"NSG=1", s.t. if the target chooses "none" (and agrees
to the stage transition by "NSG=1 T=1") - the stage
transition can occur immediately on the next initiator
Login command.

  Regards,
    Ofer

Ofer Biran