RE: iSCSI Security rough consensus

[Black_David@emc.com]

> I do not understand what a requirement for SRP to
> generate keys for ESP/IPSec would add to security,
> especially if IPSec and iSCSI are implemented on the
> same box.  Could you summarize why this recommendation
> was made?  (unfortunately, I missed this part of the
> meeting to catch a plane)

By comparison to full IPSec with IKE, using
SRP to key ESP does not improve security.
The underlying issue is IKE complexity (i.e.,
the code and effort required to implement it).

Hence the rationale for using SRP to key
ESP is that it provides dynamic key
generation without implementing IKE -- this
is an improvement over pre-shared keys at
a much lower code and effort cost for a
single-box (i.e., no external security gateway)
implementation.

Thanks,
--David

---------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 42 South St., Hopkinton, MA  01748
+1 (508) 435-1000 x75140     FAX: +1 (508) 497-8500
black_david@emc.com       Mobile: +1 (978) 394-7754
---------------------------------------------------