Re: iSCSI: 7.2.1 CHAP Considerations (12-98)

["Julian Satran" <Julian_Satran@il.ibm.com>]

can you elaborate? Julo

Steve Senum <ssenum@cisco.com> Sent by: owner-ips@ece.cmu.edu 06/12/2002 09:32 PM Please respond to Steve Senum

To:        ietf-ips <ips@ece.cmu.edu>         cc:                 Subject:        iSCSI: 7.2.1 CHAP Considerations (12-98)

I have a concern over the wording of the
following text from section 7.2.1 (12-98 version):

    When CHAP is used with secret shorter than 96 bits,
    a compliant implementation MUST NOT continue with
    the login unless it can verify that IPsec encryption
    is being used to protect the connection.

I know the above is attempt to "put some teeth" into
the requirements to make the use of CHAP secure,
but I believe there are common cases where the
length of the CHAP secret cannot be verified, such
as when a RADIUS server is being used.

Regards,
Steve Senum