Subject: RE: [Ips] Initiator CHAP authentication of target?

From: "Krueger, Marjorie" <[email-masked]>
Date: Thu, 30 Sep 2004 16:28:22 -0700

It appears a certain initiator is ignoring CHAP_N returned by the target
and just using the target node name for CHAP_N regardless of what the
target sent in the login sequence.  I think it seems like invalid
behavior but I just wanted to check with this audience.

Thanks
Marjorie

> -----Original Message-----
> From: William Studenmund [mailto:[email-masked]] 
> Sent: Thursday, September 30, 2004 3:32 PM
> To: Krueger, Marjorie
> Cc: [email-masked]
> Subject: Re: [Ips] Initiator CHAP authentication of target?
> 
> On Sep 30, 2004, at 3:22 PM, Krueger, Marjorie wrote:
> 
> > So if
> >
> >>     or, if it requires target authentication, with:
> >>
> >>        CHAP_N=<N> CHAP_R=<R> CHAP_I=<I> CHAP_C=<C>
> >>
> >>     If the initiator authentication fails, the target MUST answer 
> >> with a
> >>     Login reject with "Authentication Failure" status.
> >> Otherwise, if the
> >>     initiator required target authentication, the target 
> MUST either
> >>     answer with a Login reject with "Authentication 
> Failure" or reply
> >>     with:
> >>
> >>        CHAP_N=<N> CHAP_R=<R>
> >
> > And the target replys with CHAP_N that is not defined and the 
> > initiator accepts that (accepts anything) is that valid 
> behavior?  In 
> > otherwords, if the initiator ignores CHAP_N and only uses 
> the target 
> > node name and CHAP_R to authenticate, is that valid behavior?  
> > Shouldn't the target be able to force the use of CHAP_N?
> 
> I'm confused. The initiator can't NOT use CHAP_N. Thus the 
> target shouldn't be able to force something that's required. :-)
> 
> To quote the paragraph after the one above:
> 
>     Where N, (A,A1,A2), I, C, and R are (correspondingly) the Name,
>     Algorithm, Identifier, Challenge, and Response as defined in
>     [RFC1994], N is a text string, A,A1,A2, and I are 
> numbers, and C and
>     R are large-binary-values and their binary length (not 
> the length of
>     the character string that represents them in encoded 
> form) MUST not
>     exceed 1024 bytes.
> 
> So an initiator that just uses the target's name for CHAP 
> purposes seems broken.
> 
> Take care,
> 
> Bill
> 

_______________________________________________
Ips mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ips