[secdir] (Security sections) SecDir and AppsDir review of draft-ietf-storm-iscsi-cons-06

[Mallikarjun Chadalapaka <[e-mail]>]

Hi Alexey, here are the responses to your comments specific to security sections of iSCSI consolidated draft - actually, I am deferring mostly to Julian and David who are better suited than me to comment on this area, :-)

Mallikarjun


 
> 
> In 9.3.1:
> 
> - HMAC-SHA1 MUST be implemented [RFC2404].
> 
> RFC 2404 seems to define HMAC-SHA-1-96, not HMAC-SHA1.
[Mallikarjun:] That is true. I do not know the reason for this citing. Julian/David?

I also found it interesting that the abstract for 2404 itself does not use the "96" qualifier.

> 
> 9.3.2. Confidentiality
> 
>    The NULL encryption algorithm MUST also be implemented.
> 
> I find it odd that the section talks about how weak DES is and then
> requires NULL encryption to be supported. What is the reason for this?

 [Mallikarjun:] IIRC, I *think* this was because we wanted implementations to be able to use the authentication/MAC of IPSec suite, without forcing them always to use encryption. David, can you please add/correct?

> 
> 9.3.3. Policy, Security Associations, and Cryptographic Key
>          Management
> 
>       - When digital signatures are used to achieve authentication,
>         an IKE negotiator SHOULD use IKE Certificate Request
>         Payload(s) to specify the certificate authority. IKE
>         negotiators SHOULD check the pertinent Certificate
>         Revocation List (CRL) before accepting a PKI certificate for
>         use in IKE authentication procedures.
> 
> What are the reasons for these requirements being SHOULD level (as
> opposed to MUST level)?
> 
>    - The following identification type requirements apply to IKEv1.
>      ID_IPV4_ADDR, ID_IPV6_ADDR (if the protocol stack supports
>      IPv6) and ID_FQDN Identification Types MUST be supported;
>      ID_USER_FQDN SHOULD be supported. The IP Subnet, IP Address
>      Range, ID_DER_ASN1_DN, and ID_DER_ASN1_GN Identification Types
>      SHOULD NOT be used. The ID_KEY_ID Identification Type MUST NOT
>      be used.
> 
> It would be good to know the reason for the last SHOULD NOT and the last
> MUST NOT.

 [Mallikarjun:] I will defer to Julian and David on these.