Re: [storm] New IPsec security text for iSCSI

[Mallikarjun Chadalapaka <[e-mail]>]

Hi David,

Many thanks for proposing the new text.  I have read through the proposed
changes, and they all look consistent with the top-level summary you have
provided below.

With respect to #2 below (implementations at 1Gbps or higher), I am reading
your new text to mean different from your summary, I may just be misreading
however.  

Previous text required "MUST implement" of sequence number extension even
with IKEv1.  The new text seems to limit the MUST requirement just to those
that use IKEv2 - "... iSCSI implementation that is capable of operating  at
speeds of 1 Gbps and that implements both IKEv2..."    IMHO, the older text
already seems to have the requisite force you summarized below under #2.
Please correct if I'm off in the weeds here....

Thanks.

Mallikarjun






-----Original Message-----
From: [e-mail] [mailto:[e-mail]] 
Sent: Wednesday, October 19, 2011 3:04 PM
To: [e-mail]; [e-mail]
Subject: New IPsec security text for iSCSI

The attached text file contains the new security text for the iSCSI
consolidated draft, with differences marked against the -03 version of that
draft.  The primary changes are to rewrite the IPsec requirements as
previously announced:

	- MUST implement IPsec, 2400-series RFCs (IPsec v2, IKEv1).
	- SHOULD implement IPsec, 4300-series RFCs (IPsec v3, IKEv2).

In addition, I have made the following three IPsec requirements changes that
seemed appropriate - an important purpose of this message is to solicit
comments on them (including any objections):

	1) If IKEv2 is supported, then AES GCM SHOULD be implemented.  AES
GCM is
		(IMHO) a better choice than the combination of AES CBC MAC
with XCBC
		and AES CTR, but I did not remove the SHOULD recommendations
for
		the latter two (FWIW, both of these SHOULD be implemented
for IKEv2,
		see RFC 4307).
	2) For implementations expected to operate at 1Gbps or greater: If
ESPv3
		(part of IPsec v3) is implemented, extended (64-bit)
sequence numbers
		MUST be implemented and SHOULD be used (RFC 3720 indicated
that this
		requirement was coming, so here it is ...).
	3) DES MUST NOT be used (RFC 3720 specified that DES SHOULD NOT be
used).
		The reason for this change should be obvious ;-).

I also added a paragraph to indicate that determination of which versions of
IPsec are supported by a target is out of scope, but if both initiator and
target support both IPsec v2 and v3, then use of v3 is recommended [lower
case, this is deliberate].

Note that RFC 3723 needs to be added to the list of RFCs that are updated by
the iSCSI consolidated draft.  There will be a number of references that
will need to be added - I didn't put those into the attached text file.

Thanks,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA  01748
[phone]             FAX: [phone]
[e-mail]        Mobile: [phone]
----------------------------------------------------