RE: iSCSI Inband authentication (SRP/CHAP) - proposed resolution

[Paul Koning <ni1d@arrl.net>]

Excerpt of message (sent 23 May 2002) by Black_David@emc.com:
> [... various snips to focus on the SA replacement issue ...]
> 
> > > The encryption can probably be removed by negotiating a new SA that
> > > doesn't encrypt and deleting the old one, but that still requires
> > > ESP integrity.
> > 
> > Could we have a more complete example of this (SA changing in 
> > mid-stride)?
> 
> It is literally as described - the sender sets up a new SA, and deletes
> the old one.  These are done via IKE in the usual fashion.

Unfortunately, it's NOT the usual fashion.  It would be extremely
unusual, to say the least, for an IPsec implementation to be willing
to offer both encrypted and unencrypted SAs to the same destination.

It is probably true that the protocol permits it, but as Milan pointed
out, IPsec implementers will give you very funny looks if you suggest
this to them.

     paul