Subject: iSCSI: DLB's [T.33] 10.5 Challenge Handshake Authentication Protocol (CHAP)

From: "Rod Harrison" <[email-masked]>
Date: Sun, 7 Jul 2002 10:03:32 -0500

David,

	A MUST here seems to preclude the initiator not offering CHAP due to
administrative configuration. In fact the original SHOULD seems a bit
strong.

	I.e. is ...

	AuthMethod=none

	no longer to be valid?

	If so perhaps the text should change to require CHAP and / or none.7

	- Rod

---

From: "Ofer Biran" <[email-masked]>
Date: Sun, 7 Jul 2002 22:07:53 +0300

Rod,

Section 10 has a lot of such MUSTs for the required steps
of each authentication method. All these are applied of course
only when the relevant authentication method have been chosen
in the negotiation.

(or maybe you confused the "Algorithm" with "authentication method",
i.e., in

"For the Algorithm, as stated in [RFC1994], one value is required
to be implemented:
       5       (CHAP with MD5)..."

 the Algorithm is the CHAP_A key sent on the first CHAP step. )

 Regards,
  Ofer

Ofer Biran
Storage and Systems Technology
IBM Research Lab in Haifa
[email-masked]  972-4-8296253

"Rod Harrison" <[email-masked]>@ece.cmu.edu on 07/07/2002
18:03:32

Please respond to "Rod Harrison" <[email-masked]>

Sent by:    [email-masked]

To:    <[email-masked]>
cc:
Subject:    iSCSI: DLB's [T.33] 10.5 Challenge Handshake Authentication
       Protocol (CHAP)

David,

 I.e. is ...

 AuthMethod=none

 no longer to be valid?

 - Rod

---

From: "Ofer Biran" <[email-masked]>
Date: Mon, 8 Jul 2002 19:53:59 +0300

David,

>There's a related problem here in that the encoding of the values of the
>CHAP_A key are not specified - the quickest way out of this one would
>be to have them be numbers and refer to the IANA registry from which the
>numbers MUST be taken.

10.5 has
"Where N, (A,A1,A2), I, C, and R are (correspondingly) the Name,
Algorithm, Identifier, Challenge, and Response as defined in [RFC1994],
N is a text string, A,A1,A2, and I are numbers..."

And RFC1994 defines the Algorithm value (A,A1,A2 values of CHAP_A) :

"The Algorithm field is one octet and indicates the authentication
  method to be used.  Up-to-date values are specified in the most
  recent "Assigned Numbers" [2]   "

   Regards,
     Ofer

Ofer Biran