Re: Security Considerations

[David Robinson <David.Robinson@EBay.Sun.COM>]

Jim McGrath wrote:
> 
> For reference, what security is present today for NAS class products (e.g.
> those typically using a higher level protocol like NFS rather than SCSI)?
> 
> My impression (which I admit could be quite mistaken) is that we may be on a
> path of requiring a higher level of security for iSCSI than is warranted by
> alternative protocols.  Of course, enhancing security has its value, but
> since SCSI starts off with essentially no security, iSCSI is a poor protocol
> upon which to require lots of security.

The benchmark that iSCSI will have to meet is what is being done
in the NFSv4 WG.  Using the ONCRPC WG mechanisms based on GSSAPI
and RPCSEC_GSS they provide authentication, integrity, and privacy
using one of two manditory to implement mechanisms, Kerberos V5
and LIPKEY.

I suspect that if iSCSI doesn't address security to provide similar
capabilities it will not pass muster. Of course the security should
always be able to be negotiated to the desired levels.

	-David