GSSAPI

GSSAPI, or Generic Security Service Application Programming Interface, is a standardized API that enables applications to access security services without embedding the details of a specific security mechanism. The API provides a framework for authentication, data integrity, and data confidentiality, delegating the actual cryptographic work to underlying mechanisms such as Kerberos or NTLM.

Mechanisms are implemented as distinct modules, identified by unique mechanism identifiers (often referred to by OIDs). A negotiation mechanism, such as SPNEGO, can be used to select a common mechanism between peers. The typical interaction involves a client and a server exchanging security tokens to establish a security context. Once established, the context can be used to protect messages or to perform mutual authentication.

Key API operations include acquiring credentials (gss_acquire_cred), initializing and accepting security contexts (gss_init_sec_context, gss_accept_sec_context), displaying and importing names (gss_display_name, gss_import_name), wrapping and unwrapping data (gss_wrap, gss_unwrap), and obtaining or verifying message integrity codes (gss_get_mic, gss_verify_mic). The API represents context states (such as incomplete or complete) and supports both single- and multi-step exchanges.

Implementations and usage: Prominent implementations include MIT Kerberos and Heimdal Kerberos on Unix-like systems. Windows provides a closely related interface called SSPI, which serves similar purposes. GSSAPI is widely used in SASL-based authentication, network services, and protocols that require pluggable authentication. It is distinct from transport-layer security like TLS, as it operates at the application layer by providing a generic interface to security services.

History and standards: The GSSAPI was standardized by the IETF in the late 1990s, with subsequent updates and mechanisms such as SPNEGO to negotiate among compatible security modules.