Subject: Re: iSCSI: PAK: an alternative to SRP and DH-CHAP

From: "Bernard Aboba" <[email-masked]>
Date: Fri, 03 May 2002 10:40:02 -0700

>I'd almost buy this argument, except that means that my custommers will
>have to upgrade their environments to an updated Radius server.  >Putting 
>deployment requirements like this on custommers is not an easy >thing...

This used to be a reasonable argument when most RADIUS servers didn't 
support extensible authentication, but that isn't true anymore. Today 
customers who don't want to upgrade legacy servers often go out and buy a 
new set of servers supporting extensible authentication and deploy it for 
the new application only. That way they don't have to worry about the 
upgrades breaking legacy applications, yet they can still support new 
applications.

Also, if we were to restrict IETF authentication methods to those supported 
in RFC 2865, that would mean that that the only acceptable algorithm would 
be CHAP. Given that CHAP doesn't support mutual authentication and has a 
dictionary attack vulnerability, that seems like too tight a straightjacket 
to put ourselves in.

_________________________________________________________________
Chat with friends online, try MSN Messenger: http://messenger.msn.com

---

From: "Julian Satran" <[email-masked]>
Date: Fri, 3 May 2002 20:48:02 +0300

It will also not work on the (mostly) legacy IP-over-pigeon networks.

Julo

Bill Strahm <[email-masked]>
Sent by: [email-masked]
05/03/2002 08:39 PM
Please respond to Bill Strahm

        To:     Bernard Aboba <[email-masked]>
        cc:     [email-masked], [email-masked], [email-masked]
        Subject:        Re: iSCSI: PAK: an alternative to SRP and DH-CHAP

I'd almost buy this argument, except that means that my custommers will
have to upgrade their environments to an updated Radius server.  Putting
deployment requirements like this on custommers is not an easy thing...

I have been told that many Radius environments in organizations are rather
old and not prone to upgrading (to do it you have to shut down 
authentication
for a period of time).  That is why I refer to a legacy environment, it 
is really easy if I can just say, Please use our Radius server in place
of the one that you are all ready running...  Now would you want to base
sales on that ? 

Bill
On Fri, May 03, 2002 at 10:06:30AM -0700, Bernard Aboba wrote:
> >From my understaning of PAK, I don't see a way of plugging this into
> >a legacy RADIUS environment (I don't have the password avail at the
> >iSCSI endpoint, only the ability to say please authenticate this for 
>me)
> 
> The  RADIUS argument is a red herring. RFC 2869 defines the use of 
> extensible authentication within RADIUS, and most RADIUS servers 
(including 
> versions of FreeRADIUS) now support this. So the bottom line is the 
iSCSI 
> should choose the authentication algorithms most appropriate to its 
needs 
> and not worry about RADIUS compatibility.
> 
>