hesela.devCHAP authentication (iSCSI)
iSCSI CHAP is a shared-secret challenge-response authentication method used during iSCSI login.
The response is computed from a challenge, an identifier and a shared secret; the secret itself is not transmitted in the exchange. This verifies knowledge of a secret, not the trustworthiness of a device. [1] Captured unencrypted exchanges can still enable offline password guessing. [3]
Authenticating the initiator does not automatically authenticate the target. Mutual authentication adds the reverse check, and iSCSI requires different secrets for the two directions. [2] [3]
Authentication alone does not protect subsequent storage traffic against observation or modification. Packet protection is a separate requirement. An IPsec association can use NULL encryption, so IPsec presence alone does not establish confidentiality. [3] [4]
Relations
- related
- iSCSI, iSCSI Node Name, iSCSI Session, iSCSI digest
Citations
- RFC 1994: challenge-response mechanism, sections 2 and 4.1
- RFC 7143: CHAP login exchange, section 12.1.3
- RFC 3723: iSCSI authentication and threats, sections 2.4 and 3.1
- RFC 7146: confidentiality transforms and NULL encryption, section 2.2
Further reading
Sources & caveats
- Specification review, not an authentication or encryption deployment test. Historical algorithm requirements are not a current cipher-selection guide.