RE: iSCSI: security questions

["Lee Xing" <lxing@Crossroads.com>]

Ofer,

Thanks for the info.  Please see my comments bellow.

Regards,


Lee
Crossroads Systems, Inc.

================
Q3:
SEC-IPS v.04, page 11 "Negotiation between Initiator and Target is used
to determine which authentication algorithm to use (or whether to use
one at all); the connection closes if either side requires
authentication and no mutually acceptable algorithm can be agreed upon"

The question is whether "none" is considered as an "acceptable
algorithm".  In other words, if initiator asks
"AuthMethod=KRB5,SRP,none" during login, and target answers
"AuthMethod=none", should the connection be closed, or should the
initiator continue with LoginOperationalNegotiation stage?  If latter is
acceptable, should we reword the last sentence like "...and no mutually
acceptable algorithm or "none" can be agreed upon"?

+ "if either side requires authentication" rules out your example,
+ because by suggesting "none" and choosing "none" no side required
+ authentication.

# In iSCSI v.08, there are quite a few Login Phase 
# Examples which use "AuthMethod=KRB5,SRP,...,none".
# I'm not sure which one (the Login Phase Examples, or 
# your comments) is more appropriate.