Subject: Re: iSCSI: DH-CHAP resolution

From: "John Hufferd" <[email-masked]>
Date: Tue, 7 May 2002 10:58:51 -0700

Does this mean that DH-CHAP, is not to be even a MAY implement?  Or was
your statement only about it being a MUST?

.
.
.
John L. Hufferd
Senior Technical Staff Member (STSM)
IBM/SSG San Jose Ca
Main Office (408) 256-0403, Tie: 276-0403,  eFax: (408) 904-4688
Home Office (408) 997-6136, Cell: (408) 499-9702
Internet address: [email-masked]

"Elizabeth G. Rodriguez" <[email-masked]>@ece.cmu.edu on
05/07/2002 11:30:28 AM

Sent by:    [email-masked]

To:    <[email-masked]>
cc:
Subject:    iSCSI: DH-CHAP resolution

All,

As mentioned previously, the consensus call for DH-CHAP was very close.  As
a result, Allision Mankin requested security expertise be consulted further
prior to declaring consensus on the issue.

The result is that security experts believe that DH-CHAP, while from the
reading, DH-CHAP seems to be a worthy solutionbut, as many have stated both
to me and the ADs privately as well as on the mailing list,

it is unproven.  As such, the decision has been made to NOT include DH-CHAP
as an authentication mechanism for iSCSI.

Now, the next question will be how will this effect the mandatory to
implement authentication mechanism decision.  The Transport ADs still have
significant concerns about IPR issues as they relate to SRP as the
mandatory to implement mechanism.  They also feel that (as has been
expressed on the mailing list) we do not have concrete requirements listed
for the authentication mechanism.  As such, Allison is in the process of
calling a meeting between the Security and Transport ADs. This will likely
occur some time late this week.

I realize that everyone is anxious to close on this issue.  I assure you it
is being worked, and that the delay is related to making sure that iSCSI
has the best chance of success, both in the IETF review process as well as
the corporate environment.

Thanks,

Elizabeth Rodriguez

IPS co-chair

---

From: "Lee Xing" <[email-masked]>
Date: Tue, 7 May 2002 13:55:47 -0500

Compare with CHAP, is DH-CHAP any better?  If it is, why we don't want to include DH-CHAP but CHAP as an authentication mechanism for iSCSI?
 
Thanks.

Lee

-----Original Message-----
From: Elizabeth G. Rodriguez [mailto:[email-masked]]
Sent: Tuesday, May 07, 2002 1:30 PM
To: [email-masked]
Subject: iSCSI: DH-CHAP resolution
Importance: High

All,

As mentioned previously, the consensus call for DH-CHAP was very close.  As a result, Allision Mankin requested security expertise be consulted further prior to declaring consensus on the issue.

The result is that security experts believe that DH-CHAP, while from the reading, DH-CHAP seems to be a worthy solution but, as many have stated both to me and the ADs privately as well as on the mailing list,

it is unproven.  As such, the decision has been made to NOT include DH-CHAP as an authentication mechanism for iSCSI.

Now, the next question will be how will this effect the mandatory to implement authentication mechanism decision.  The Transport ADs still have significant concerns about IPR issues as they relate to SRP as the mandatory to implement mechanism.  They also feel that (as has been expressed on the mailing list) we do not have concrete requirements listed for the authentication mechanism.  As such, Allison is in the process of calling a meeting between the Security and Transport ADs. This will likely occur some time late this week.

I realize that everyone is anxious to close on this issue.  I assure you it is being worked, and that the delay is related to making sure that iSCSI has the best chance of success, both in the IETF review process as well as the corporate environment.

Thanks,

Elizabeth Rodriguez

IPS co-chair

---

From: "Julian Satran" <[email-masked]>
Date: Thu, 9 May 2002 01:45:55 +0300

John,

I read it as being about the MAY - unproven means it's time has not come 
yet.
I hope we can close sometime next week. I plan to start the "countdown" to 
13 during the weekend.

Julo

John Hufferd/San Jose/IBM@IBMUS
Sent by: [email-masked]
05/07/2002 08:58 PM
Please respond to John Hufferd

        To:     "Elizabeth G. Rodriguez" <[email-masked]>
        cc:     <[email-masked]>
        Subject:        Re: iSCSI: DH-CHAP resolution

.
.
.
John L. Hufferd

"Elizabeth G. Rodriguez" <[email-masked]>@ece.cmu.edu 
on
05/07/2002 11:30:28 AM

To:    <[email-masked]>
cc:

All,

As mentioned previously, the consensus call for DH-CHAP was very close.  
As
a result, Allision Mankin requested security expertise be consulted 
further
prior to declaring consensus on the issue.

The result is that security experts believe that DH-CHAP, while from the
reading, DH-CHAP seems to be a worthy solutionbut, as many have stated 
both
to me and the ADs privately as well as on the mailing list,

it is unproven.  As such, the decision has been made to NOT include 
DH-CHAP
as an authentication mechanism for iSCSI.

I realize that everyone is anxious to close on this issue.  I assure you 
it
is being worked, and that the delay is related to making sure that iSCSI
has the best chance of success, both in the IETF review process as well as
the corporate environment.

Thanks,

Elizabeth Rodriguez

IPS co-chair