Subject: RE: [Ips] Authentication

From: [email-masked]
Date: Fri, 6 May 2005 10:17:46 -0400

> Is the authentication phase mandatory as per the RFC?

It is not mandatory to use (the word "MUST" was not applied),
but it is strongly recommended (SHOULD).  Support for CHAP MUST
be implemented.  See RFC 2119 for what these words mean.

> Also, can you have only target authentication with no initiator
> authentication?

No.  If one is concerned about whether the holder of the data
is actually whom she claims to be (target authentication), one
should probably be concerned about whether the client accessing
the data is whom she claims to be (initiator authentication).

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Smitha Narayanaswamy (smithan)
> Sent: Friday, May 06, 2005 8:29 AM
> To: [email-masked]; 'linux-iscsi-devel'
> Cc: 'Bindu Thota (bthota)'; 'Arpakorn Boonkongchuen (aboonkon)'
> Subject: [Ips] Authentication
> 
> Hi,
> 
> Is the authentication phase mandatory as per the RFC?
> Also, can you have only target authentication with no initiator
> authentication?
> 
> The RFC seemed contradictory when we have:
> "
> 3.2.3.  iSCSI Login
> <...>
>    As part of the login process, the initiator and target SHOULD
>    authenticate each other and MAY set a security association protocol
>    for the session.  This can occur in many different ways and is
>    subject to negotiation.
> "
> and
> "
> 5.3.  Login Phase
> <...>
>    In some environments, a target or an initiator is not interested in
>    authenticating its counterpart.  It is possible to bypass
>    authentication through the Login Request and Response.
> "
> and
> "
> 8.2.  In-band Initiator-Target Authentication
> 
>    During login, the target MAY authenticate the initiator and the
>    initiator MAY authenticate the target.  The authentication is
>    performed on every new iSCSI connection by an exchange of iSCSI
> Login
>    PDUs using a negotiated authentication method.
> "
> 
> Thanks,
> Smitha
> 
> 
> _______________________________________________
> Ips mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ips
> 

_______________________________________________
Ips mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ips