iSCSI requirements drafts

[biran@il.ibm.com]

Just two comments on the Security Considerations:

The iSCSI draft states that
"iSCSI implementations MUST provide means of
protection against active attacks (pretending as another
identity, message insertion, deletion, and modification)".
This might be reflected in a MUST statement in section 6.3
(which I would rename to "Data Integrity and Authentication ")

Also - I would rename the "CRC" occurrences in the MAY/MUST
statements on the beginning of 6.3 to "digest", as digests with
real security value may be negotiated (this is one method of
providing the above MUST).  CRC is one type of digest (that
doesn't provide security value, just error detection).

  Regards,
     Ofer


Ofer Biran
Storage and Systems Technology
IBM Research Lab in Haifa
biran@il.ibm.com  972-4-8296253