|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] RE: Notes from IPS meetingWhere can I find the "SCSI Command Ordering Draft"? Eddy -----Original Message----- From: Elizabeth G. Rodriguez [mailto:Elizabeth.G.Rodriguez@123mail.net] Sent: Friday, March 28, 2003 12:19 AM To: ips@ece.cmu.edu Subject: FW: Notes from IPS meeting Here are the minutes from the IPS meeting last week. Please review and let David and/or I know of any comments/corrections/issues by 5pm EST on Tuesday April 1. Thanks, Elizabeth Rodriguez ---- IPS Working Group - Tuesday, March 18, 2003 Status of Drafts - Per the IETF ID Tracker, located at https://datatracker.ietf.org/public/pidtracker.cgi Most thru working group last call. A few approved for publication. Status: Publication Requested (these are standards track documents which have just recently been forwarded to the ADs for initial review) Auth MIB FC Mgmt MIB iFCP MIB iSCSI MIB Status: AD Evaluation FCIP SLP (has completed expert review. Same expert review applies to iSCSI SLP) iSCSI SLP Stringprep iSNS Status: IESG Evaluation/AD Followup Naming and discovery - Back to ADs for review after revisions made in response to IESG feedback Status: IESG Evaluation/Revised ID needed Boot draft sent back due to security problems. Issues discussed later in session. Status: RFC Editor Queue (Approved for Publication) FC Common Encapsulation IPS Security iSCSI FCIP iFCP These documents are in the RFC Editor Queue and are pending references. To see the dependencies these drafts are awaiting, see http://www.rfc-editor.org/queue.html. Long poll on the iSCSI RFC assignment is waiting on the AES Counter draft. Possible expedition after references are completed. Question was asked about status of FC-BB-2 publication. Craig Carlson (T11.3 Chair) stated that the ANSI publication process is slow and final publication may not be available for 6 months. Status: ID Exists Three of these drafts (SCSI MIB, FCIP MIB, iSNS MIB) are almost ready to be forwarded. Nit checks have already occurred, and the drafts are being reviewed by Keith McCloghrie. Three of these drafts (fcencaps-wglc, fcip-wglc, ifcp-wglcc) are drafts written in response to WG Last Call comments, and these drafts will soon be expired. The Name-Ext draft is a new draft approved as a WG item in Atlanta, and discussed later in the session. --- Boot draft Presented by John Hufferd, on behalf of Prasenjit Sarkar The boot draft has been sent back to the working group for further work, due to security issues. Need to address boot communications security only; Boot image integrity outside purview Software stage: not allowed in a secure boot because of integrity issues The boot environment is many times extremely constrained verses a fully operational environment. A limit of 64K is possible. Need to keep security fairly straightforward; getting too complex takes things backwards. Proposal: Use IPsec (common in wireless networks) takes care of IP addr initialization problem Bernard Aboba suggest use DHCP auth like ESP in IPsec Question for the IPS WG do we want another protocol at boot How to use IPsec w/o IP address - taken care of in wireless community. Bernard Aboba: Resources in boot processes very constrained. IPsec in boot PROM is possible, but IKE definitely will not fit. DHCP-AUTH probably works, but IPsec with IKE probably doesn't. Need to consider a staged approach. IPsec is reasonable at stage two. Recommendation from presentation: Boot stage: Use IPsec Not allowed: Pre-shared keys (dynamic IP addresses) Aboba suggest handling like iSCSI (aggressive mode) Accepted Public keys (disallowed by IPS Security draft) Manual Keying (provisioning hassle) Comments: If someone is really interested in security, they want it all the way down to level zero boot. How do we integrate security mechanisms in the boot loader? Not every mode of operation needs to be secure, but at least one mode does need to be secure. Verification of boot image is very difficult. DHCP-Auth makes sense, at boot, security depends on site security usage. If the second stage boot requires IPSEC, then the adapter better have that ability available. Need to be able to 'tickle' the IPsec functionality on the hardware. Big concern is that the Key probably needs to be in flash. Key exchange may not happen - instead may use manual key for only the boot, and the SA is torn down immediately after booting. There is a basic provisioning problem here. Direction for draft -- Two phase process. First: DHCP with DHCP-auth as necessary. Second: iSCSI to get boot image. IPsec used here, with simple key management. Pre-shared keys are better than manual keys, but provisioning problem is the same for both if they are burned into the card. Pre-shared allows a session key to be generated so lifetime is longer. Comment by Kevin Gibbons: iSNS has feature where boot target can be specified. This is as a addition to SLP. --- iSCSI naming extension draft Presented by Mallikajurn The T10 had two votes, the Grand Unified SCSI device name format passed first vote in working group, but was narrowly defeated in 2nd vote at plenary. This probably implies that this is not dead yet, but notion of common format with iSCSI is dead. Would have another form. This draft does not defined LU name, but Rob Elliot's proposal requires transports to defined the syntax of a logical unit name. Direction for draft: Keep it alive here. Add Rob Elliot's additional requirements in the T10 proposal which requires transports to define syntax of Logical Unit Name --- SCSI Command Ordering Draft Presented by Mallikajurn Motion to accept this as an official working group item. No objections. Will accept as working group draft. This is an implementer's notes draft. We can not produce too many such drafts. In Vienna will continue discussion and decide if other implementation observations (if any) need to be rolled in, or if this can proceed stand alone.
Home Last updated: Fri Mar 28 14:19:21 2003 12436 messages in chronological order |