[storm] New IPsec security text for iSCSI

[<[e-mail]>]

The attached text file contains the new security text for the iSCSI consolidated
draft, with differences marked against the -03 version of that draft.  The primary
changes are to rewrite the IPsec requirements as previously announced:

	- MUST implement IPsec, 2400-series RFCs (IPsec v2, IKEv1).
	- SHOULD implement IPsec, 4300-series RFCs (IPsec v3, IKEv2).

In addition, I have made the following three IPsec requirements changes that seemed
appropriate - an important purpose of this message is to solicit comments on them
(including any objections):

	1) If IKEv2 is supported, then AES GCM SHOULD be implemented.  AES GCM is
		(IMHO) a better choice than the combination of AES CBC MAC with XCBC
		and AES CTR, but I did not remove the SHOULD recommendations for
		the latter two (FWIW, both of these SHOULD be implemented for IKEv2,
		see RFC 4307).
	2) For implementations expected to operate at 1Gbps or greater: If ESPv3
		(part of IPsec v3) is implemented, extended (64-bit) sequence numbers
		MUST be implemented and SHOULD be used (RFC 3720 indicated that this
		requirement was coming, so here it is ...).
	3) DES MUST NOT be used (RFC 3720 specified that DES SHOULD NOT be used).
		The reason for this change should be obvious ;-).

I also added a paragraph to indicate that determination of which versions of IPsec
are supported by a target is out of scope, but if both initiator and target support
both IPsec v2 and v3, then use of v3 is recommended [lower case, this is deliberate].

Note that RFC 3723 needs to be added to the list of RFCs that are updated by the
iSCSI consolidated draft.  There will be a number of references that will need to
be added - I didn't put those into the attached text file.

Thanks,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA  01748
[phone]             FAX: [phone]
[e-mail]        Mobile: [phone]
----------------------------------------------------