Subject: RE: [Ips] Security and iSCSI and IPv6

From: [email-masked]
Date: Wed, 1 Nov 2006 10:04:25 -0500

The IPsec requirements for iSCSI are IPv6 vs. IPv4 independent for
the most part.  Section 8.3.3 of RFC 3720 requires ID_IPV6_ADDR
support when IPv6 is supported.
 
Thanks,
--David
---------------------------------------------------- 
David L. Black, Senior Technologist 
EMC Corporation, 176 South St., Hopkinton, MA  01748 
+1 (508) 293-7953             FAX: +1 (508) 293-7786 
[email-masked]        Mobile: +1 (978) 394-7754 
---------------------------------------------------- 

________________________________

	From: [email-masked] [mailto:[email-masked]] 
	Sent: Tuesday, October 31, 2006 6:27 PM
	To: [email-masked]
	Subject: [Ips] Security and iSCSI and IPv6

	Are the any mandatory requirements around support for IPSec for
iSCSI targets that claim IPv6 compliance?

	Any insight would be greatly appreciated.

	Thanks,

	Jacob

_______________________________________________
Ips mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ips

---

From: <[email-masked]>
Date: Wed, 1 Nov 2006 09:51:24 -0600

David,
 
We wanted to find out, if iSCSI spec mandates initiator or target to
support any aspect of IPSEC (authentication or encryption) in IPv6 or
IPv4 environment. or Is IPSEC completely optional?
 
Section 8.3.1 in RFC 3720 states that:

	An iSCSI compliant initiator or target MUST provide data
integrity
	   and authentication by implementing IPsec [RFC2401] with ESP
[RFC2406]
	   in tunnel mode and MAY provide data integrity and
authentication by
	   implementing IPsec with ESP in transport mode.  The IPsec
	   implementation MUST fulfill the following iSCSI specific
	   requirements:
	 
	     - HMAC-SHA1 MUST be implemented [RFC2404].
	     - AES CBC MAC with XCBC extensions SHOULD be implemented
	       [RFC3566].
	 
	   The ESP anti-replay service MUST also be implemented.

Thanks, 
Gaurav

From: [email-masked] [mailto:[email-masked]] 
Sent: Wednesday, November 01, 2006 9:04 AM
To: Cherian, Jacob; [email-masked]
Subject: RE: [Ips] Security and iSCSI and IPv6

Thanks,
--David

	Thanks,

	Jacob

---

From: [email-masked]
Date: Wed, 1 Nov 2006 11:30:42 -0500

Gaurav,
 
I think you answered your own question ...
 
IPsec is mandatory in the iSCSI RFCs for both IPv4 and IPv6.
 
I would have thought that at least the first "MUST" in the
green text you quoted from RFC 3720 would suffice to make
this clear.
 
--David

	From: [email-masked] [mailto:[email-masked]] 
	Sent: Wednesday, November 01, 2006 10:51 AM
	To: Black, David; [email-masked]; [email-masked]
	Cc: [email-masked]
	Subject: RE: [Ips] Security and iSCSI and IPv6

	David,
	 
	We wanted to find out, if iSCSI spec mandates initiator or
target to support any aspect of IPSEC (authentication or encryption) in
IPv6 or IPv4 environment. or Is IPSEC completely optional?

		An iSCSI compliant initiator or target MUST provide data
integrity
		   and authentication by implementing IPsec [RFC2401]
with ESP [RFC2406]
		   in tunnel mode and MAY provide data integrity and
authentication by
		   implementing IPsec with ESP in transport mode.  The
IPsec
		   implementation MUST fulfill the following iSCSI
specific
		   requirements:
		 
		     - HMAC-SHA1 MUST be implemented [RFC2404].
		     - AES CBC MAC with XCBC extensions SHOULD be
implemented
		       [RFC3566].

	Thanks, 
	Gaurav

	The IPsec requirements for iSCSI are IPv6 vs. IPv4 independent
for
	the most part.  Section 8.3.3 of RFC 3720 requires ID_IPV6_ADDR
	support when IPv6 is supported.
	 
	Thanks,
	--David

		From: [email-masked]
[mailto:[email-masked]] 
		Sent: Tuesday, October 31, 2006 6:27 PM
		To: [email-masked]
		Subject: [Ips] Security and iSCSI and IPv6

		Are the any mandatory requirements around support for
IPSec for iSCSI targets that claim IPv6 compliance?

		Thanks,

		Jacob