Subject: I-D ACTION:draft-ietf-ips-security-11.txt

From: [email-masked]
Date: Tue, 05 Mar 2002 06:19:52 -0500

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the IP Storage Working Group of the IETF.

	Title		: Securing Block Storage Protocols over IP
	Author(s)	: B. Aboba et al.
	Filename	: draft-ietf-ips-security-11.txt
	Pages		: 65
	Date		: 04-Mar-02
	
This document discusses how block storage protocols running over IP,
including iSCSI, iFCP and FCIP, can utilize IPsec for security.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-ips-security-11.txt

To remove yourself from the IETF Announcement list, send a message to 
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-ips-security-11.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-ips-security-11.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: David Jablon <[email-masked]>
Date: Thu, 07 Mar 2002 21:00:56 -0500

A new draft that is relevant to the SRP authentication protocol
is available at:
http://search.ietf.org/internet-drafts/draft-jablon-speke-00.txt

SRP, as defined in RFC2945, and referenced in draft-ietf-ips-security-11.txt,
has technical and IP issues, that are addressed in this draft.

    Title       : The SPEKE Password-Based Key Agreement Methods
    Author(s)   : D. Jablon
    Filename    : draft-jablon-speke-00.txt
    Pages       : 25
    Date        : 13-Feb-02
        
This document describes SPEKE, B-SPEKE, and SRP-4, three methods for
password-based key agreement and authentication. In the same class of
techniques as SRP-3 [RFC 2945], these methods provide a zero-knowledge
proof of a password and authenticate session keys over an unprotected
channel, with minimal dependency on infrastructure and proper user
behavior. These methods are compatible with IEEE 1363 and ANSI X9
standards, and are closely aligned with RFC 2945 from an application
perspective. They are also based on different fundamental techniques than
earlier patented alternatives, providing an expanded set of choices for
convenient and secure personal authentication over the Internet. 

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-jablon-speke-00.txt

-- David

---------------------------------------------------
David Jablon
[email-masked]
tel: 508 898 9024

---

From: Tom Wu <[email-masked]>
Date: Thu, 07 Mar 2002 15:31:07 -0800

> has technical and IP issues, that are addressed in this draft.

The SPEKE techniques are, to my knowledge, patent-encumbered and
non-free, whereas SRP has a free patent license from Stanford and IP
issues that are nearing resolution.  It seems that presenting these
techniques as fixes to "issues" with SRP (instead of as a supplement) is
misleading in this context.

Unless SPEKE, or some variant thereof, is made available under a license
as liberal as the SRP license, it seems that it would be more
appropriate to consider it for a future optional authentication method,
as opposed to a mandatory one.

> http://www.ietf.org/internet-drafts/draft-jablon-speke-00.txt

Tom
-- 
Tom Wu
Principal Software Engineer
Arcot Systems
(408) 969-6124
"The Borg?  Sounds Swedish..."

---

From: David Jablon <[email-masked]>
Date: Fri, 08 Mar 2002 15:04:01 -0500

Regarding the proposed alternatives to SRP-3 ...
(http://search.ietf.org/internet-drafts/draft-jablon-speke-00.txt)

At 03:31 PM 3/7/02 -0800, Tom Wu wrote:
>issues that are nearing resolution. [...]

First, your phrasing may suggest to some that the existence of the patent
is or was hidden.  The commercial intentions for the SPEKE protocols and
their patent status have been public knowledge since the first published
paper in 1996, and the draft is clear on this too.

>[...] It seems that presenting these 

Stanford's generosity notwithstanding, today, there is an outstanding
working group issue with SRP-3 and other patents.  David Black has
urged me to try to get Phoenix to clarify its position on SRP-3, and I'm
in the process of doing just that.  If you find specific text in the draft that
is "misleading" in this context, or any other context, show me and I'll try to
improve it promptly.  I also see no problem with the supplement approach.

The draft is intended to facilitate public analysis of both patent issues
and the technical merits of SRP-3 and the SPEKE, B-SPEKE and SRP-4
alternatives.  For some people, the relative technical merits of SRP-3 and these
alternatives may be minor -- they may shop around, first, based on price, and
only then based on these differences.

The bigger concern is when people don't shop around at all and leave
major technical issues unaddressed.

>as opposed to a mandatory one.

There's also a lot of room between MUST and MAY, and between 
free and affordable.  The only thing that I find really annoying, and kind of scary,
is when standards preclude or actively discourage strong options.

-- David