Re: ISCSI: User authentication vs. Machine Authentication for iSCSI

[Mark Bakke <mbakke@cisco.com>]

John-

Just wanted to point out that CHAP does not send passwords
in the clear; it hashes them.  The reason that SRP was chosen
as the MUST over CHAP is that in a non-IPsec environment, 
the CHAP exchange is not as robust as SRP's exchange, and is
more vulnerable to some types of attacks (I can't remember
which ones off-hand).  IPsec provides an authenticated
environment in which to do the CHAP exchange, which takes
care of these potential problems.

--
Mark

John Hufferd wrote:
> 3. Chap can  be used in this environment since the Link is already secure
> and encrypted, and sending the password in what otherwise would have been
> in the clear, is protected by the link encryption.

-- 
Mark A. Bakke
Cisco Systems
mbakke@cisco.com
763.398.1054