RE: iSCSI Security rough consensus

[Bernard Aboba <aboba@internaut.com>]

> > Yes, CRCs are still required for data integrity (e.g.,
> > when ESP is not present).  If one knows that ESP with
> > its keyed HMAC is being used in the stack between TCP and
> > IP, then it would make sense not to use CRCs at the iSCSI
> > level, hence they're required to implement, but configurable
> > to use (which will also be the case for ESP).

The issue here is where the data invalidation is coming from. If it is
occuring on the wire, then IPSEC will solve the problem and a CRC (or a
TCP checksum for that matter) is redundant. However, if it is occuring
later, then IPSEC may not be an appropriate solution, particularly since
acceleration technologies mean that IPSEC may be stripped off even before
the packet is moved off the interface for the first time. 

Ultimately the decision should rest on consideration of the
empirical evidence of where the problem is.