RE: Auth method negotiation

[pat_thaler@agilent.com]

Bill,

I agree that the target made an error in sending T=1 when it chose an authentication method. 

However, even if it was willing to skip negotiation it must return CHAP when offered AuthMethod=KRB5,SRP,CHAP,None.

4.3.2 says "-The target MUST reply with the first option in the list it
supports and is allowed to use for the specific initiator
unless it does not support any in which case it MUST answer
with "Reject" (see also Section 4.2 Text Mode Negotiation).
The parameters are encoded in UTF8 as key=value. For security
parameters, see Chapter 10."

So if the target supports CHAP and is allowed to use CHAP for an initiator it MUST reply with CHAP or an earlier alternative in the list when offered CHAP before None for AuthMethod. It cannot reply None. If the initiator would have preferred "None" over "CHAP" it should have placed it before CHAP in the list.

I think that the next text in 4.3.2 is a bit confusing:
"-The initiator must be aware of the imminent completion of the
SecurityNegotiation stage and MUST set the T bit to 1 and the
NSG to what it would like the next stage to be. The target
will answer with a Login response with the T bit set to 1 and
the NSG to what it would like the next stage to be. The next
stage selected will be the one the target selected. If the
next stage is FullFeaturePhase, the target MUST respond with
a Login Response with the Session ID and the protocol version."

I think "aware of imminent completion" means that the target has sent its last key=value of the security negotiation but it doesn't seem a very clear way to say it.
Also, the next sentence is not always true. The target might not be ready to set the T bit in the answering Login Response. It might have required more than one PDU to send its final key(s) of the security negotiation. "The target will then set the T bit to 1 and set NSG to the next stage in the Login response where it finishes sending its security keys." would be more accurate.

Pat

-----Original Message-----
From: Bill Studenmund [mailto:wrstuden@wasabisystems.com]
Sent: Friday, June 21, 2002 4:19 PM
To: Chirag Wighe
Cc: ips@ece.cmu.edu
Subject: Re: Auth method negotiation


On Fri, 21 Jun 2002, Chirag Wighe wrote:

> Hi
>
> I am sorry for the typo but I cut and paste from the spec. In the spec on
> page 245 for example it says
> If the initiator authentication is successful, the target proceeds:
> T- Login (CSG,NSG=0,1 T=1)
> I- Login (CSG,NSG=1,0 T=0)

Oh, if T=0, then NSG is reserved, and should have the value 0.

> ... iSCSI parameters
> T- Login (CSG,NSG=1,0 T=0)
> ... iSCSI parameters
>
> I did a search and there are several other 1,0 transitions in the spec.

Were they transitions, i.e. T=1? Or just notifications of continuing
operational parameter negotiation? That's what (CSG,NSG=1,0 T=0) is.

> Anyway what I meant was what Bill intepreted it to be which was
> Login (CSG,NSG=0,1 T=1)
> InitiatorName=iqn.1999-07.com.os.hostid.77
> TargetName=iqn.1999-07.com.acme.diskarray.sn.88
> AuthMethod=KRB5,SRP,CHAP,None
>
> and the target replying
> T- Login-PR (CSG,NSG=0,1 T=1)
> AuthMethod=CHAP
>
> and then my other questions hopefully make more sense.

I think the concensus is that the target made an error. If it was willing
to skip security negotiations (T=1, NSG=1), it shouldn't have chosen CHAP.

Take care,

Bill