Re: [storm] iSCSI: Authentication mechanism reduction

  Hm... Kerberos is widely deployed even if common iSCSI initiators are 
not using it.
Wouldn't it be wiser to "revive" the GSSAPI version and have it replace 
the current wording.
And it is certainly better than to be left with CHAP :-) (as the primary).

Julo

On 22/05/10 04:43, Black_David@emc.com wrote:
> <WG chair hat off>
>
> I'd like to propose removal of a few authentication mechanisms.  RFC 3720 currently specifies five authentication mechanisms:
> 	- Kerberos (KRB5)
> 	- Simple public key (SPKM1 and SPKM2)
> 	- Secure Remote Password (SRP)
> 	- Challenge Handshake (CHAP)
>
> To my knowledge, SPKM1 and SPKM2 have never been implemented and are not in use.  KRB5 has been implemented, but my understanding is that it is not in use, and I understand that the specific iSCSI usage of Kerberos isn't considered be the proverbial "right thing" to do because it's not based on GSSAPI.  There was an Internet-Draft on adding GSSAPI-based Kerberos authentication to iSCSI, but it's long since expired.
>
> So, I would suggest removal of the KRB5, SPKM1 and SPKM2 methods from the iSCSI consolidated draft with suitable reservation of the authentication method names and negotiation key prefixes (KRB_AP_, SPKM_) to prevent future reuse.
>
> Thanks,
> --David
> ----------------------------------------------------
> David L. Black, Distinguished Engineer
> EMC Corporation, 176 South St., Hopkinton, MA  01748
> +1 (508) 293-7953             FAX: +1 (508) 293-7786
> black_david@emc.com        Mobile: +1 (978) 394-7754
> ----------------------------------------------------
>
> _______________________________________________
> storm mailing list
> storm@ietf.org
> https://www.ietf.org/mailman/listinfo/storm