iSCSI: 7.2.1 CHAP Considerations (12-98)

[Steve Senum <ssenum@cisco.com>]

I have a concern over the wording of the
following text from section 7.2.1 (12-98 version):

    When CHAP is used with secret shorter than 96 bits,
    a compliant implementation MUST NOT continue with
    the login unless it can verify that IPsec encryption
    is being used to protect the connection.

I know the above is attempt to "put some teeth" into
the requirements to make the use of CHAP secure,
but I believe there are common cases where the
length of the CHAP secret cannot be verified, such
as when a RADIUS server is being used.

Regards,
Steve Senum