Return-Path: <owner-ips@ece.cmu.edu>
X-Sieve: cmu-sieve 2.0
Return-Path: <owner-ips@ece.cmu.edu>
Received: (from majordom@localhost)
	by ece.cmu.edu (8.11.0/8.10.2) id h16EreR11310
	for ips-outgoing; Thu, 6 Feb 2003 09:53:40 -0500 (EST)
X-Authentication-Warning: ece.cmu.edu: majordom set sender to owner-ips@ece.cmu.edu using -f
Received: from best.eurologic.com (no-dns-yet.demon.co.uk [80.177.61.148] (may be forged))
	by ece.cmu.edu (8.11.0/8.10.2) with ESMTP id h16ErZW11302;
	Thu, 6 Feb 2003 09:53:35 -0500 (EST)
Received: from there (wombat [192.168.7.41])
	by best.eurologic.com (8.9.3+Sun/8.9.3) with SMTP id OAA19369;
	Thu, 6 Feb 2003 14:53:52 GMT
Message-Id: <200302061453.OAA19369@best.eurologic.com>
Content-Type: text/plain;
  charset="iso-8859-1"
From: Ken Sandars <ksandars@eurologic.com>
Organization: Eurologic Systems
To: Julian_Satran@il.ibm.com
Subject: iSCSI: Authenticating with SRP
Date: Thu, 6 Feb 2003 14:49:22 +0000
X-Mailer: KMail [version 1.3.1]
Cc: ips@ece.cmu.edu, owner-ips@ece.cmu.edu
References: <1BEBA5E8600DD4119A50009027AF54A00ECB3D74@axcs04.cos.agilent.com>
In-Reply-To: <1BEBA5E8600DD4119A50009027AF54A00ECB3D74@axcs04.cos.agilent.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: owner-ips@ece.cmu.edu
Precedence: bulk

Hi Julo,

When authenticating with SRP, I'm not sure exactly which parameters are 
required. In particular, the example in appendix C conflicts with section 
11.1.3.

Based on the example login transaction (Appendix C):

     I-> Login (CSG,NSG=0,1 T=1)
         InitiatorName=iqn.1999-07.com.os:hostid.77
         TargetName=iqn.1999-07.com.example:diskarray.sn.88
         AuthMethod=KRB5,SRP,None

     T-> Login-PR  (CSG,NSG=0,0 T=0)
         AuthMethod=SRP

     I-> Login (CSG,NSG=0,0 T=0)
         SRP_U=bob
         TargetAuth=Yes

     T-> Login (CSG,NSG=0,0 T=0)
         SRP_g=2
         SRP_s=0X12343456745ABCDS (well, lots o' hex digits)
         SRP_N=??????

In 11.1.3, the suggested sequence is:

     I-> Login (CSG,NSG=0,1 T=1)
         InitiatorName=iqn.1999-07.com.os:hostid.77
         TargetName=iqn.1999-07.com.example:diskarray.sn.88
         AuthMethod=KRB5,SRP,None

     T-> Login-PR  (CSG,NSG=0,0 T=0)
         AuthMethod=SRP

     I-> Login (CSG,NSG=0,0 T=0)
         SRP_U=bob
         TargetAuth=Yes

     T-> Login (CSG,NSG=0,0 T=0)
         SRP_GROUP=SRP-768,SRP-1024,SRP-1280,SRP-1536,SRP-2048
         SRP_s=0X12343456745ABCDS (well, lots o' hex digits)

     I-> Login (CSG,NSG=0,0 T=0)
         SRP_A=0xABCDEF12345345354
         SRP_GROUP=SRP-1536

       ......


I don't understand this sequence, and neither does the initiator we are 
playing with! ;-)

The first sequence doesn't negotiate the SRP_GROUP parameter, and the second 
doesn't let the target provide a SRP_N or a SRP_g.

Should the full sequence be (try 1):

     I-> Login (CSG,NSG=0,1 T=1)
         InitiatorName=iqn.1999-07.com.os:hostid.77
         TargetName=iqn.1999-07.com.example:diskarray.sn.88
         AuthMethod=KRB5,SRP,None

     T-> Login-PR  (CSG,NSG=0,0 T=0)
         AuthMethod=SRP

     I-> Login (CSG,NSG=0,0 T=0)
         SRP_U=bob
         TargetAuth=Yes

     T-> Login (CSG,NSG=0,0 T=0)
         SRP_GROUP=SRP-768,SRP-1024,SRP-1280,SRP-1536,SRP-2048
         SRP_s=0X12343456745ABCDS (well, lots o' hex digits)

     I-> Login (CSG,NSG=0,0 T=0)
         SRP_GROUP=SRP-1536

     T-> Login (CSG,NSG=0,0 T=0)
         SRP_g=2
         SRP_N=0XABCD123132523453 (as per SRP_GROUP)

     I-> Login (CSG,NSG=0,0 T=0)
         SRP_A=0xABCDEF12345345354

      .... and things proceed from here


However, this introduces an extra step which may be collapsed (try 2):

     I-> Login (CSG,NSG=0,1 T=1)
         InitiatorName=iqn.1999-07.com.os:hostid.77
         TargetName=iqn.1999-07.com.example:diskarray.sn.88
         AuthMethod=KRB5,SRP,None

     T-> Login-PR  (CSG,NSG=0,0 T=0)
         AuthMethod=SRP
         SRP_GROUP=SRP-768,SRP-1024,SRP-1280,SRP-1536,SRP-2048

     I-> Login (CSG,NSG=0,0 T=0)
         SRP_GROUP=SRP-1536
         SRP_U=bob
         TargetAuth=Yes

     T-> Login (CSG,NSG=0,0 T=0)
         SRP_g=2
         SRP_s=0X12343456745ABCDS (well, lots o' hex digits)
         SRP_N=0XABCD123132523453 (as per SRP_GROUP)

     I-> Login (CSG,NSG=0,0 T=0)
         SRP_A=0xABCDEF12345345354

      .... and things proceed from here


Does this look right? 

Thanks,
Ken





Ken Sandars
Eurologic Systems
Howard House
Queens Avenue
Bristol
United Kingdom
-----------------------------
Tel : +44 (0)117 9309616
Fax : +44 (0)117 9309601
-----------------------------