All,
As mentioned previously, the
consensus call for DH-CHAP was very close. As a result, Allision Mankin
requested security expertise be consulted further prior to declaring consensus
on the issue.
The result is that security
experts believe that DH-CHAP, while from the reading, DH-CHAP seems to be a
worthy solution but,
as many have stated both to me and the ADs privately as well as
on the mailing list,
it is
unproven. As such, the decision has been made to NOT include DH-CHAP as
an authentication mechanism for iSCSI.
Now, the next question will be how
will this effect the mandatory to implement authentication mechanism
decision. The Transport ADs still have significant concerns about IPR
issues as they relate to SRP as the mandatory to implement mechanism.
They also feel that (as has been expressed on the mailing list) we do not have
concrete requirements listed for the authentication mechanism. As such,
Allison is in the process of calling a meeting between the Security and
Transport ADs. This will likely occur some time late this week.
I realize that everyone is anxious
to close on this issue. I assure you it is being worked, and that the
delay is related to making sure that iSCSI has the best chance of success,
both in the IETF review process as well as the corporate
environment.
Thanks,
Elizabeth
Rodriguez
IPS co-chair
