iSCSI: DH-CHAP

All,

Please expect another email, from the Transport ADs, on the topic of

SRP and intellectual property issues.

As was discussed both in Minneapolis and over the reflector, there is

concern over the MUST implement status of SRP, and the group is tasked

with the responsibility of evaluating both SRP as well as other alternatives,

to make the best possible choice(s) for the iSCSI authentication mechanisms.

Mentioned in Minneapolis was the possibility of CHAP enhanced by use of a

Diffie-Hellman Exchange. David Black has authored an individual draft on

this topic. The DH-CHAP draft, draft-black-ips-iscsi-dhchap-00.txt has been

submitted to the I-D servers and is also available at

The draft is an individual submission that the IPS WG is free to

(quoting from the draft abstract) "adopt, modify, reject, fold,

spindle, and/or mutilate as it sees fit". Since David Black will be

participating in the resulting discussion as an individual and author

of the draft, and not as a WG co-chair, I will be the WG chair

responsible for this draft and for determining WG rough consensus

on this set of issues.

The goal of this discussion is to determine the appropriate level

of requirements (MUST/SHOULD/MAY implement) for the inband iSCSI

authentication mechanisms (SRP and CHAP as specified in the

iSCSI draft, DH-CHAP as documented above), and more importantly

to come to consensus on a solid technical rationale for these

requirement levels. While I understand the level of frustration

and impatience with this situation, I have a few requests to make

of participants in this discussion:

- Civility and respect for other members of the WG are virtues;

please practice these virtues early and often.

- Discussion of requirements levels (MUST/SHOULD/MAY) in the absence

of technical rationale is an invitation to confusion. Please

summarize the technical rationale when advocating a requirements

level.

- Unbounded speculation about possible IPR claims is unproductive

Each case in which the IPS WG has taken up discussion of a

possible IPR claim has been based on existence of a patent

or a publicly-disclosed patent application. It is only

appropriate to discuss possible IPR claims on the list when

they meet this criteria. Those with IPR concerns that do

not meet this criteria should contact me directly off the

list so that I can determine how to proceed in consultation

with the Area Directors.

Thank you all for your help on these matters.

Elizabeth Rodriguez

IPS WG co-chair