Subject: is 1 Gbps a MUST?

From: "CAVANNA,VICENTE V (A-Roseville,ex1)" <[email-masked]>
Date: Thu, 21 Feb 2002 16:06:51 -0700

If my interpretation is correct, the current (and earlier ones too) security
draft at  http://www.drizzle.com/~aboba/RDMA/draft-ietf-ips-security-10.txt
seems to say that an IPSec implementation MUST be capable of running at 1
Gbps. I quote from the draft:
"Given current networking technology, IP block storage security solutions
must be implementable at 1 Gbps in terms of CPU overhead and/or availability
of suitable hardware implementations and should be implementable at 10 Gbps
in the near future. 10 Gbps implementations are desirable but are not an
absolute requirement as implementation feasibility at these speeds is not
yet demonstrated. "
On the other hand I hear a lot of talk about TOEs in hardware and IPSec in
software. Given that, once IPSec is turned on, *every* incoming packet must
be inspected to confirm compliance with the security policy, I find it hard
to believe that a software implementation can be claimed to be compliant. In
fact a software implementation implies introducing a bottleneck in front of
the TOE.
Am I misinterpreting the requirement or am I underestimating the potential
performance of a software implementation?
Vince Cavanna
Agilent Technologies

---

From: "Bernard Aboba" <[email-masked]>
Date: Thu, 21 Feb 2002 16:19:20 -0800

>Am I misinterpreting the requirement or am I underestimating the >potential 

You're misinterpreting the requirement. It should probably just say 
something like "the security protocol should be capable of...", since the 
requirement doesn't apply to implementations. Feel free to go ahead and make 
your products as slow as you need to :)

_________________________________________________________________
MSN Photos is the easiest way to share and print your photos: 
http://photos.msn.com/support/worldwide.aspx

---

From: "Martin, Nick" <[email-masked]>
Date: Thu, 21 Feb 2002 18:41:41 -0600

Vince,

I read this as limiting IP block storage security protocols for iSCSI to those which can be done at wire speed using some current technology.  This does not mean that each implementation must do so, nor that it must be possible to do it both in hardware and also in software.  It means to me, if no-one can make it run at wire speed using current technology, we must not select it.

If neither software with acceptable CPU overhead, nor a suitable hardware implementation are possible, the protocol is disqualified.

Thanks,
Nick
> -----Original Message-----
> From: CAVANNA,VICENTE V (A-Roseville,ex1)
> [mailto:[email-masked]]
> Sent: Thursday, February 21, 2002 5:07 PM
> To: [email-masked]'
> Cc: SHEEHY,DAVE (A-Americas,unix1); CAVANNA,VICENTE V 
> (A-Roseville,ex1);
> THALER,PAT (A-Roseville,ex1)
> Subject: is 1 Gbps a MUST?
> 
> 
> draft at  
> http://www.drizzle.com/~aboba/RDMA/draft-ietf-ips-security-10.txt

---

From: "CAVANNA,VICENTE V (A-Roseville,ex1)" <[email-masked]>
Date: Fri, 22 Feb 2002 11:44:01 -0700

Hi Paul,

I agree with everything you said.  What I was hoping to get comments on, is
my interpretation of Jonathan Stone's claim and its implications to IPSec. 

Jonathan pointed out the need for bandwidth*RoundTripDelay worth of
buffering per TCP connection to avoid a cliff-effect drop in performance;
and I extrapolated the need to have no bottlenecks (such as IPSec) anywhere
in the path to those buffers. From my perspective IPSec, or at least the
part of IPSec that discriminates between secured and unsecured traffic, had
better not be a bottleneck or IPSec will not be turned on at all.

Vince

|-----Original Message-----
|From: Paul Koning [mailto:[email-masked]]
|Sent: Friday, February 22, 2002 6:55 AM
|To: [email-masked]
|Cc: [email-masked]
|Subject: Re: is 1 Gbps a MUST?
|
|
|>>>>> "Vince" == A-Roseville,ex1  <CAVANNA> writes:
|
| Vince> Thanks for the clarification. Something still bothers me
| Vince> however.  If IPSec is a bottleneck (because the policy lookup
| Vince> is done in software) then the receiver may be forced to drop
| Vince> packets quite frequently. Such behavior could have a dramatic
| Vince> effect on performance as explained in a memo that Jonathan
| Vince> Stone posted on 2/5/02 (attached) and in my interpretation
| Vince> which I did not post on 2/6/02 (attached). Comments?
|
|Your assumption "policy lookup is done in software" is not necessarily
|valid -- just like the popular assertion "TCP is slow because it is
|done in software" is not necessarily valid.
|
|Apart from that, the fact that it's done in software doesn't
|necessarily make it slow.  It is certainly doable with a decent
|network processor to do SPD lookup at 1Gb/s line speeds in software.
|
|Note also that SPD lookup for encrypted traffic is often quite easy.
|You already have the inbound SA (and that lookup is trivial if you
|assign SAIDs sensibly).  You can bind to that the list of SPD entries
|-- often just one -- describing the traffic that is allowed to travel
|on that SA, so you have no search, only a compare of the SPD entry
|with the address/port/protocol fields of the packet.
|
|Going back to the original question, I read the statement in the
|security spec as a protocol requirement, not an implementation
|requirement -- so it constrains the choice of security protocol.
|IPsec ESP can be implemented to run at the specified speeds in the
|timeframes called for (the whole thing -- not just the crypto
|primitives) so it satisfies that requirement on the protocol.  (It's
|not trivial to achieve this -- nor is it inexpensive -- but it *can*
|be done if you really want to.)  But there is no requirement on
|implementations to run at that speed, of course.
|
|It would be good for the security spec wording to be clarified so
|makes it explicit that this is a protocol selection requirement, not
|an implementation requirement.
|
|   paul
|

---

From: "Zamer, Ahmad" <[email-masked]>
Date: Fri, 22 Feb 2002 12:56:21 -0800

Hi,

I would like to echo John's view of this topic.

Regards,
Ahmad Zamer
Intel Corporation
voice: 512-407-2155
mail: [email-masked]

-----Original Message-----
From: John Hufferd [mailto:[email-masked]] 
Sent: Friday, February 22, 2002 1:59 PM
To: [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: RE: is 1 Gbps a MUST?

Folks,
There will be folks that will operate on 100 Mb/s links and will use iSCSI
with Encryption.  To say that they do not comply with the spec, for that
reason, is a bit silly.

Likewise, I believe there will be many desktops and laptops that will
support 10/100/1000 ethernet adapters and be thrilled with 300 Mb/s, it is
also not reasonable to say that they can not claim compliance.

The spec is intended to say that the protocol must be capable of being
supported at 1 Giga bit per second.  I think most of us agree that it is.

So to say that those folks that do not operate at gigabit speed are non
compliant is inappropriate.

.
.
.
John L. Hufferd
Senior Technical Staff Member (STSM)
IBM/SSG San Jose Ca
Main Office (408) 256-0403, Tie: 276-0403,  eFax: (408) 904-4688
Home Office (408) 997-6136, Cell: (408) 499-9702
Internet address: [email-masked]

[email-masked]@ece.cmu.edu on 02/22/2002 10:54:15 AM

Sent by:    [email-masked]

To:    [email-masked]
cc:    [email-masked], [email-masked], [email-masked],
       [email-masked]
Subject:    RE: is 1 Gbps a MUST?

Hi Fred,

|
|I won't respond to the wording of the draft, but to the sense
|that it must
|be intended to convey. If the wording doesn't convey this, it is the
|wording which must change.
|
|It seems to me that if the transfer of encrypted data at
|nominal link rates
|is expected, then encryption and decryption must be achieved
|at link rates.
|If 1 GBPS link rates are in view, guess what rates are
|important. If 10 GBPS...

Unfortunately some believe that they can be iSCSI compliant by having a
slow
implementation of IPSec and claiming that most traffic will not require
security processing. I am not one of those persons. I think that at least
the policy check must occur at link speed regardless of what proportion of
traffic requires security processing.

|
|It seems to me that the question is not whether or not you are
|mandated to
|implement IPSEC in software, but what you need to do to
|accomplish link
|speed encryption and decryption. Hardware and software are
|duals; you can
|implement the algorithm either way, and the trade-off is money
|vs speed.

I agree, and I did not mean to imply otherwise. I am trying to gather
opinions from this group on whether link speed encryption/decryption is
necessary, especially now that Bernad Aboba has clarified that the spec
does
not mandate it.

Vince

---

From: "Bernard Aboba" <[email-masked]>
Date: Sat, 23 Feb 2002 12:28:13 -0800

Hopefully the following paragraph will address this issue:

"To be useful, IP block storage security protocols must be capable of being 
implemented at the line rates in use today or likely to be used in the 
future. For example, CPU overhead and hardware availability  must not 
preclude implementation at 1 Gbps today. Implementation feasibility at 10 
Gbps is highly desirable, but may not be demonstratable at this time. 
Performance issues are discussed further in Appendix B. "

---

From: Digital Aryan <[email-masked]>
Date: Sun, 24 Feb 2002 20:44:14 -0800 (PST)

I would like to add that though it is not necessary,
for an implememtation to follow all the words provided
in the draft, it is necessary for the draft to provide
the various possible ways of getting itself
implemented. Then, whether an implementation is able
to attract market attention depends on the requirement
of the market.

Aryan

__________________________________________________
Do You Yahoo!?
Yahoo! Sports - Coverage of the 2002 Olympic Games
http://sports.yahoo.com