Subject: iSCSI: Last call comments

From: Mark Bakke <[email-masked]>
Date: Wed, 03 Jul 2002 16:47:42 -0500

The iSCSI draft is looking pretty good.  I only have one last-call
comment left:

There are a few sections in iSCSI (and ips-security) that discuss
IPsec requirements for "compliant/conformant implementations".  I
recall that this meant a target implementation could either be a
single device with both iSCSI and IPsec, or a combination of two
devices, one that handles iSCSI; the other handling IPsec.  However,
I couldn't find anywhere in the spec that spells this out either
way, other than a hint at it in item [3] on page 31 of ips-security-13:

> [3]  IPsec is provided by a device external to the actual iSCSI device.
>      Here the iSCSI header and data CRCs can be kept across the part of
>      the connection that is not protected by IPsec. For instance, the
>      iSCSI connection could traverse an extra bus, interface card,
>      network, interface card, and bus between the iSCSI device and the
>      device providing IPsec. In this case, the iSCSI CRC is desirable,
>      and the iSCSI implementation behind the IPsec device may request
>      it.

As there are many cases where it makes a lot of sense to provide
the solution in two pieces (iSCSI in one or more devices, with one or
more IPsec front-end devices, I'd like to clarify this.

How about (somewhere in section 7) adding something like:

   An iSCSI compliant initiator or target may provide the required
   IPsec support either by itself, or in conjunction with an IPsec
   front-end device.

Any thoughts?

--
Mark

For reference, here are a few of the statements that would be
helped out by the above.

iscsi-14 Section 7.3.1:

   An iSCSI compliant initiator or target MUST provide data integrity 
   and authentication by implementing IPsec [RFC2401] with ESP [RFC2406] 
   in tunnel mode and MAY provide data integrity and authentication by 
   implementing IPsec with ESP in transport mode. The IPsec implementa-
   tion MUST fulfill the following iSCSI specific requirements:

iscsi-14 Section 7.3.2:

   An iSCSI compliant initiator or target MUST provide confidentiality 
   by implementing IPsec [RFC2401] with ESP [RFC2406] in tunnel mode and 
   MAY provide confidentiality by implementing IPsec with ESP in trans-
   port mode. with the following iSCSI specific requirements:

iscsi-14 Section 7.3.3:

     - Conformant iSCSI implementations MUST support IKE Main Mode 
           and SHOULD support Aggressive Mode. 

---
ips-security-13 Section 2.3.1:

All IP block storage security compliant implementations MUST support
IPsec ESP [RFC2406] to provide security for both control packets and
data packets, as well as the replay protection mechanisms of IPsec.
When ESP is utilized, per-packet data origin authentication, integrity
and replay protection MUST be used.

-- 
Mark A. Bakke
Cisco Systems
[email-masked]
763.398.1054

---

From: [email-masked]
Date: Wed, 3 Jul 2002 17:54:28 -0400

Mark,

> devices, one that handles iSCSI; the other handling IPsec.

In the two device combination, only the combination is compliant,
and only at the interface(s) that provide(s) both iSCSI and IPsec.
The iSCSI device in the combination is not compliant by itself
because it does not provide IPsec.

>    IPsec support either by itself, or in conjunction with an IPsec

It would need to have the word "compliant" removed and a sentence
added to spell out what is compliant, along the lines of:

    An iSCSI initiator or target may provide the required
    IPsec support either by itself, or in conjunction with an IPsec
    front-end device.  In the latter case only the combination
    complies with the requirements of this specification; the
    individual iSCSI initiator or target would not comply with
    the requirements of this specification due to the lack of IPsec
    support.

It's probably a good idea to put this in.

Thanks,
--David
---------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 42 South St., Hopkinton, MA  01748
+1 (508) 249-6449            FAX: +1 (508) 497-8018
[email-masked]       Mobile: +1 (978) 394-7754
---------------------------------------------------

> -----Original Message-----
> From: Mark Bakke [mailto:[email-masked]]
> Sent: Wednesday, July 03, 2002 5:48 PM
> To: IPS
> Subject: iSCSI: Last call comments
> 
> 
>